feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/server/session.ts

@@ -3,6 +3,7 @@ import type { User } from "@prisma/client";
 import { logger } from "../logger";
 import { prisma } from "./db";
 import { getSessionPepper } from "./env";
+import { claimGuestRulesForUser } from "./guestRuleClaim";
 import { hashSessionToken, newSessionToken } from "./hash";
 
 /**
@@ -136,6 +137,12 @@ export async function createSessionForUser(
     logger.warn("[session] expired-row cleanup failed", err);
   }
 
+  try {
+    await claimGuestRulesForUser(userId);
+  } catch (err) {
+    logger.warn("[session] guest rule claim failed", err);
+  }
+
   return { token, expiresAt };
 }