fix(ui): clear session caches at the identity boundary and give the wallet view a loader

[argszero]

Summary

Live in ui/js/app.js is a per-session cache, but nothing ever cleared it when the identity changed — and renderView's wallet branch was the only one without a loader. So after Alice used the dashboard and logged out, Bob opening the wallet saw Alice's Live.wallet.balance rendered into #wallet-forever ("永久点数" / permanent points) — and it never self-healed, because that view never fetched anything itself.

This PR fixes both halves at once.

Related Issue

None (no matching issue; found by inspection + a jsdom instrument).

Changes

Two halves, both required (removing either leaves a red face):

1. Identity boundaries drop every cache slot. New resetSessionCaches() derives the slot names from the Live object literal itself (Object.keys(Live)), so a newly added slot is covered automatically; a hand-written roster is rejected by the gate. It is called at both identity boundaries:
   • session end — exitGuest() (logout button + __atpLogout on 401);
   • session establishment — the top of loadSession() (boot and login both go through restoreSession()).
2. The wallet view gets its own loader. renderView("wallet") becomes renderWallet(); if (loggedIn()) loadWallet();, with loadWallet() mirroring the tail of loadDashboard() (refreshWallet() → renderWallet()).

Half 2 also fixes a single-session display bug: logging in and going straight to the wallet left Live.wallet null forever, so the cell fell back to D.USER.balance — which is available (balance + gift_balance, src/routes/wallet.rs), i.e. permanent points plus today's gift shown as if it were the permanent balance.

No new i18n keys; ui/index.html cache-bust bumped to app.js?v=20260915-5.

• 功能/修复说明
• 涉及配置/数据结构的改动已同步示例文件（无配置/数据结构改动）

Tests

• cargo test 全部通过 — 271 passed (was 269; +2 new gate tests)
• cargo fmt --check 通过
• 新增/更新了单元测试（如适用）

Static gate — src/state_gate.rs (test-only, zero new deps)

Two derived invariants added:

• the_identity_boundaries_drop_every_session_cache — the reset must be derived (contains Object.keys(Live)), must not contain a per-slot assignment (a second roster would rot), and must be called from both loadSession and exitGuest.
• the_view_router_renders_and_loads_in_every_branch — every renderView branch line must contain both a render and a load.

Both carry an extractor self-proof and synthetic input (a hand-written roster / a branch without a loader must go red).

A/B (both instruments, four legs)

DOM probe: jsdom booting the real ui/index.html + the four real scripts, only fetch stubbed; drives the real nav buttons, the real logout button and the real login form; two accounts whose wallets differ and where available != balance.

leg	probe red set	gate red set
pre-change tree (a81839b:ui/js/app.js)	{B1, B2, B3}	{identity, view-router}
loader only, caches never cleared	{B3}	{identity}
caches cleared, no loader	{B1, B2}	{view-router}
this branch	{} (13/13)	{} (6/6)

The three red sets are mutually disjoint and their union is the pre-change red set — i.e. each half-fix fixes exactly one face and leaves the other. Both half-fixes are also rejected by the static gate, which is the evidence that the gate (not the DOM probe) pins the direction.

Probe faces:

• B1 — #wallet-forever shows the signed-in account's permanent balance (was Alice's 4,242.42424 instead of Bob's 7.5);
• B2 — the wallet view issues a /api/wallet request of its own (was none);
• B3 — landing on the dashboard, the synchronous first frame never shows another account's numbers (was Alice's month_use = 12,345.6789).

Note on B3: it only has teeth when Bob lands on the dashboard. If he lands on the wallet, the wallet's new loader refreshes the shared Live.wallet slot during login and the leak becomes invisible — which is exactly why the "loader only" half-fix can pass a naively-built probe.

Checklist

• 分支命名符合约定（fix/）
• Commit message 使用 Conventional Commits 格式
• 单一职责，改动最小化