fix(recording): gate /rec on real session before creating transcription

## Problem
On `/rec`, the personal transcription history renders through a mock identity even when the real SessionProvider is anonymous or its database dependency is unavailable. The page therefore looks authenticated, but creating `POST /recording/realtime-asr/sessions` fails later with a generic error.

Observed locally on 2026-08-12:
- web: 127.0.0.1:3015
- API target: 127.0.0.1:3215
- API database target: 127.0.0.1:55433
- database listener was absent, yet the page still rendered as a usable authenticated screen.

## Expected
- Personal `/rec` uses the real SessionProvider identity and session token.
- Anonymous/stale sessions redirect to `/login` before the create UI is usable.
- Dependency failures render the standard authenticated-shell dependency state.
- Valid authenticated creation still forwards pending tags and succeeds.

## Verification
- Add a UI regression proving `/rec` cannot use mock identity to bypass session gating.
- Keep the existing personal transcription history/create tests green.

This is a focused F164 regression repair. It is outside the current readiness queue because the user reproduced a blocking failure on the signed personal realtime transcription flow.

Start at the /rec flow and the real SessionProvider, then inspect the existing personal transcription history/create tests and the POST /recording/realtime-asr/sessions path. Verify that anonymous or stale sessions redirect to /login, dependency failures use the standard authenticated-shell state, and valid authenticated creation forwards pending tags while the regression test prevents mock identity bypass.

Written by the indexing model from the issue text.