Update the deferred-security advice for the cutover

DEFERRED_SECURITY.md item 1 still told the calendar to move its session
credentials from query parameters into X-Session-Id/X-Session-Key. That
was the right advice when two other modules read those headers; both
stopped in the cutover, so following it now would build a second
mechanism just as the first is being retired. The fix is the shared
admin identity, which closes the item outright rather than moving the
credential somewhere safer.

Also annotates the one assertion in auth-binding.ts that cannot
currently fail. It is kept deliberately - it is a tripwire against
someone reintroducing a header-session fallback for calendar users who
have not been invited yet, which is the shortcut this whole step exists
to close - but that was worth saying out loud rather than leaving it to
look like an oversight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/admin/auth-binding.ts

@@ -102,6 +102,11 @@ export const describeAdminBinding = (
 			expect(res.locals.admin).toMatchObject({id: 'u1', email: 'a@nachklang.art', displayName: 'Anna Admin'});
 		});
 
+		// Weaker than it looks and kept deliberately: neither module imports
+		// checkSession any more, so this cannot fail today. It is a tripwire for
+		// the change that would matter - someone reintroducing a header-session
+		// fallback "just for the calendar users who have not been invited yet",
+		// which is exactly the shortcut the cutover exists to close.
 		it('never falls back to a calendar header session', async () => {
 			m.getSession.mockResolvedValue(null);