Loads a session under the caller's identity and enforces ownership (UserID === contextUser.ID). It
deliberately does NOT reject Closed sessions: the final channel-state flush and the recording terminal
signal legitimately arrive after the session closed. A scoped-anonymous widget guest owns the session it
minted, so the same check covers it; loading as the caller also applies the entity's row-level security.
Loads a session under the caller's identity and enforces ownership (
UserID === contextUser.ID). It deliberately does NOT rejectClosedsessions: the final channel-state flush and the recording terminal signal legitimately arrive after the session closed. A scoped-anonymous widget guest owns the session it minted, so the same check covers it; loading as the caller also applies the entity's row-level security.