CRAP: daemon handlers and server (needs splits) #3424

Purpose

Burn down part of the coverage-based CRAP list from #3414.

Findings (main 5f84627d8)

Owned files

• src/daemon/handlers/session-state.ts
• src/daemon/server/http-server.ts
• src/daemon/request-lock-policy.ts
• src/daemon/server/http-authorization.ts
• src/daemon/artifact-archive.ts
• src/daemon/session-script-writer.ts

Notes

handleSessionStateCommands (CC 34), handleAppStateCommand (CC 30) and the http-server.ts:188 handler (CC 45) are already 92–96% covered. Their CC alone keeps CRAP at or above 30, so they need splits, not tests. On hold: coordinate with the src/daemon → packages/daemon extraction before starting, so the work doesn't collide with planned moves.

Completion

• Every function above is absent from pnpm check:coverage-crap --all on the PR head (score < 30), or is exempted where this issue says so.
• Tests go through the owning module's public entry point. No new production exports for tests and no test-only DI (docs/agents/testing.md).
• Only the owned files, the tests that exercise them, and *.fixtures.ts helpers change. The PR stays under the 1,000-line gross budget, and pnpm check:affected --run passes on the pushed head.

Part of #3414.