feat: let guests publish a CommunityRule and claim it on this browser later

Finalize no longer requires a magic link. Guest rows stay off the catalog until sign-in on the same browser attaches ownership, and the login modal kebab no longer acts as a second close.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/sessionLifecycle.test.ts

@@ -38,10 +38,15 @@ vi.mock("next/headers", () => ({
   cookies: vi.fn(),
 }));
 
+vi.mock("../../lib/server/guestRuleClaim", () => ({
+  claimGuestRulesForUser: vi.fn().mockResolvedValue(0),
+}));
+
 import {
   createSessionForUser,
   pruneExpiredSessions,
 } from "../../lib/server/session";
+import { claimGuestRulesForUser } from "../../lib/server/guestRuleClaim";
 
 beforeEach(() => {
   sessionCreateMock.mockReset();
@@ -50,6 +55,8 @@ beforeEach(() => {
   newSessionTokenMock.mockReset();
   hashSessionTokenMock.mockReset();
   loggerWarnMock.mockReset();
+  vi.mocked(claimGuestRulesForUser).mockReset();
+  vi.mocked(claimGuestRulesForUser).mockResolvedValue(0);
 
   getSessionPepperMock.mockReturnValue("test-pepper");
   newSessionTokenMock.mockReturnValue("token-raw");
@@ -109,6 +116,7 @@ describe("createSessionForUser cleanup behaviour", () => {
     expect(result.token).toBe("token-raw");
     expect(result.expiresAt).toBeInstanceOf(Date);
     expect(sessionCreateMock).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(claimGuestRulesForUser)).toHaveBeenCalledWith("user-1");
     expect(sessionDeleteManyMock).toHaveBeenCalledTimes(1);
     const arg = sessionDeleteManyMock.mock.calls[0]?.[0] as {
       where: { userId?: string; expiresAt: { lt: Date } };