[L-5] MaintenanceMiddleware bypass uses unvalidated $_SESSION['user_id']

Resolved.

MaintenanceMiddleware now requires $_SESSION['_auth_validated_at'] in addition to $_SESSION['user_id'] before considering an admin bypass (src/Middleware/MaintenanceMiddleware.php). In public-browsing routes (where AuthMiddleware doesn't run), a fabricated session cookie can no longer cause the maintenance block to skip.

Legitimate admins browsing public pages will still bypass once they've hit any auth-required route and been validated by AuthMiddleware that session — which is already the case when toggling maintenance from the admin panel.

Locking this thread.