* fix(draft-mode): keep draft secret out of client defines
The draft-mode bypass token was emitted through Vite define, so Vite's client env payload and client chunks could contain the server-only cookie secret when app code referenced that env key.
The violated boundary was treating a server runtime credential like a shared compile-time define. Generate one plugin-scoped secret and initialize server entries with it, while next/headers reads only internal server state.
Adds regression coverage for dev env exposure, production client bundle leakage, and the built server draft cookie round trip.
* test(draft-mode): initialize secret after module reset
* fix(draft-mode): scope draft secret to request context
Draft mode validation briefly lived in a package-global singleton after removing the client-visible define. That made multiple app instances in the same process able to overwrite each other's validator.
Thread the generated app secret through the App Router request and dispatch boundaries, store it on HeadersContext, and make cache bypass validation a pure request-plus-secret check. Add a regression that proves two contexts keep independent draft validators.
* fix(draft-mode): guard stale draft controls
Nathan Nguyen