Add SPA session validation and buglist, update migration docs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

app/RSpade/Core/SPA/Spa.js

@@ -40,6 +40,9 @@ class Spa {
     // Timer ID for 30-minute auto-disable
     static _spa_timeout_timer = null;
 
+    // Flag to track if initial load is complete (for session validation)
+    static _initial_load_complete = false;
+
     /**
      * Disable SPA navigation - all navigation becomes full page loads
      * Call this when errors occur or forms are dirty
@@ -697,6 +700,30 @@ class Spa {
             // this content renders, so we need a second attempt after the page is fully ready.
 
             console_debug('Spa', `Rendered ${action_name} with ${target_layouts.length} layout(s)`);
+
+            // Session validation after navigation
+            // Validates that client state (window.rsxapp) matches server state.
+            // Detects:
+            // 1. Codebase updates (build_key changed) - new deployment
+            // 2. User changes (name, role, permissions updated)
+            // 3. Session changes (logged out, ACLs modified)
+            //
+            // Only runs on subsequent navigations, not:
+            // - Initial page load (window.rsxapp is fresh from server)
+            // - Back/forward navigation (force: true) - restoring cached state
+            //
+            // On mismatch, triggers location.replace() for transparent refresh
+            // that doesn't pollute browser history.
+            if (Spa._initial_load_complete && !options.force) {
+                // Fire and forget - don't block navigation on validation
+                Rsx.validate_session();
+            }
+
+            // Mark initial load complete for subsequent navigations
+            if (!Spa._initial_load_complete) {
+                Spa._initial_load_complete = true;
+            }
+
         } catch (error) {
             console.error('[Spa] Dispatch error:', error);
             // TODO: Better error handling - show error UI to user