Show privacy popup on launch, gate login on legal consent, and link
user agreement and privacy policy pages in the mini program.
Co-authored-by: Cursor <cursoragent@cursor.com>
Return sessionToken from login endpoints and store it client-side because
wx.request cannot rely on Set-Cookie. Also fix multi-cookie parsing,
start on login page, and guard chat rendering fields.
Co-authored-by: Cursor <cursoragent@cursor.com>