Generate Widget Session

Generate a Terra widget session for user authentication.

The User row is not required (and not created) at this point — the Terra auth webhook handler creates it once the user actually completes the provider connection.

We pass a fresh, never-reused reference_id (not the Firebase UID) so Terra never sees the same reference twice across reinstalls — that's what stops the duplicate-account / orphaned-data bleeding (#979, #1094): no ambiguous state, user_reauth never fires. The Firebase UID and the device timezone (from the X-Device-Timezone header, PR #529) are persisted on a TerraSession row keyed by the widget session id Terra returns. The auth webhook reads the row by widget_session_id to recover the identity and canonicalize the reference to the imperfect-api user id.