fix(stress): port harnesses to v1.2 single-session API + remove WS-batch hang

Local API stress (lib.mjs / api_stress.mjs):
- setupSession now does login -> /admin/api/reset and returns sid="main".
  Drops the dead /admin/api/quizzes + /admin/api/sessions calls left over
  from the multi-quiz codex era.
- bootServer writes the fixture pool (STRESS_POOL by default) to a tmp
  file and passes QUIZ_POOL_PATH so the v1.2 server has a session at
  startup.
- happyPath: drop the post-connect lobby_update wait (race with snapshot
  dispatch) and stop double-driving the lifecycle (next() already opens
  the next question, an explicit open() afterwards is a no-op).
- cross_session: rewritten as "cookie not honored on a non-existent sid"
  since v1.2 hosts a single canonical session.

Live accuracy stress (live_accuracy.mjs):
- Per-student lobby-snapshot timeout (12s) with WS error/close rejection,
  so a stalled handshake no longer hangs Promise.all until the outer
  shell timeout (which produced the exit=124 cycles).
- Open all student WSs in parallel (mirrors what real students do); the
  batch-of-8 throttle was masking the question we wanted answered.
- Instructor WS open also bounded by a 15s race so any failure surfaces
  as actionable error text instead of a silent stall.

Bootstrap (deploy/bootstrap.sh):
- Stage 1 provisions a 2GB swap file (idempotent) with vm.swappiness=10.
  1GB-RAM ECS instances OOM-kill uvicorn under WS-burst start-of-class
  pressure; swap absorbs the spike without affecting steady state.
- Pool seeding prefers examples/demo10_pool.json over the 2-question
  example so a fresh deploy boots with a usable demo.

Pool fixture (examples/demo10_pool.json):
- 10-question generic-knowledge demo pool, gitignore exception added.

tests/stress/lib.mjs

@@ -21,10 +21,15 @@ export function logLine(scenario, level, msg, extra = {}) {
 export function pickRandom(arr) { return arr[Math.floor(Math.random() * arr.length)]; }
 export function rand(min, max) { return Math.random() * (max - min) + min; }
 
-// Boot a fresh server on its own port + DB. Returns { url, stop }.
-export async function bootServer({ port, secret = "stress-secret-12345678", adminPw = "stresspw" } = {}) {
+// Boot a fresh server on its own port + DB + pool file. Returns { url, stop }.
+// v1.2 single-session: server reads ONE pool from $QUIZ_POOL_PATH at startup.
+// We write STRESS_POOL (or the supplied `pool`) to a file in a fresh tmp dir
+// per server, so concurrent harness processes don't share state.
+export async function bootServer({ port, secret = "stress-secret-12345678", adminPw = "stresspw", pool = STRESS_POOL } = {}) {
   const tmp = mkdtempSync(join(tmpdir(), "quiz-stress-"));
   const dbPath = join(tmp, "stress.db");
+  const poolPath = join(tmp, "pool.json");
+  writeFileSync(poolPath, JSON.stringify(pool), "utf-8");
   const env = {
     ...process.env,
     QUIZ_DB_PATH: dbPath,
@@ -33,6 +38,8 @@ export async function bootServer({ port, secret = "stress-secret-12345678", admi
     QUIZ_HOST: "127.0.0.1",
     QUIZ_PORT: String(port),
     QUIZ_PUBLIC_URL: `http://127.0.0.1:${port}`,
+    QUIZ_POOL_PATH: poolPath,
+    QUIZ_SESSION_ID: "main",
   };
   const proc = spawn(
     `${QUIZ_ROOT}/.venv/bin/uvicorn`,
@@ -101,16 +108,18 @@ export async function jsonReq(method, url, { jar, body, headers = {} } = {}) {
   return { status: r.status, ok: r.ok, data, headers: r.headers };
 }
 
-// Build admin session: login + upload pool + create session. Returns { sid, jar }.
-export async function setupSession(serverUrl, adminPw, pool) {
+// v1.2 single-session: pool is loaded at startup from $QUIZ_POOL_PATH and sid
+// is fixed (default "main"). setupSession() now just authenticates the admin
+// and resets the canonical session so each scenario starts from the lobby.
+// The `pool` arg is accepted but unused; kept so call sites stay readable
+// (pool is set at bootServer time, not per-scenario).
+export async function setupSession(serverUrl, adminPw, _poolUnused) {
   const jar = new CookieJar();
   const login = await jsonReq("POST", `${serverUrl}/admin/login`, { jar, body: { password: adminPw } });
   if (!login.ok) throw new Error(`admin login failed: ${login.status} ${JSON.stringify(login.data)}`);
-  const create = await jsonReq("POST", `${serverUrl}/admin/api/quizzes`, { jar, body: { pool_json: pool } });
-  if (!create.ok) throw new Error(`quiz create failed: ${create.status} ${JSON.stringify(create.data)}`);
-  const sess = await jsonReq("POST", `${serverUrl}/admin/api/sessions`, { jar, body: { quiz_id: create.data.quiz_id } });
-  if (!sess.ok) throw new Error(`session create failed: ${sess.status} ${JSON.stringify(sess.data)}`);
-  return { sid: sess.data.sid, jar };
+  const reset = await jsonReq("POST", `${serverUrl}/admin/api/reset`, { jar, body: {} });
+  if (!reset.ok) throw new Error(`reset failed: ${reset.status} ${JSON.stringify(reset.data)}`);
+  return { sid: "main", jar };
 }
 
 // Student wrapper: join + connect WS + collect messages.