Spread-aware client alerts need a session fallback before route aggregation

Observation (2026-09-08 UTC, Shield/theft COR-4098 PR #813): when fatal client logs lack a flow ID, grouping immediately by route template plus error fingerprint collapses independent browser sessions and can invert widespread-versus-loop classification. A safe hierarchy is typed flow ID → typed browser session ID → typed route template, always paired with the bounded error fingerprint; aggregate away the temporary identity before notification rendering. Reproducible fixtures should prove three missing-flow sessions classify as widespread while ten repeats from one session classify as a loop. The exact nested LogQL template parsed and evaluated through production Loki read-only, and no Grafana state was mutated. Provenance: PR diff, emitted data_browser_session_id contract, local fixture validator, and live Loki query parsing/evaluation.