refactor(water-log): centralize brand + session primitives

Phase 1 of the water-log auth refactor. No behavior change.

NEW:
- src/lib/water-log/brand.ts       — single source of TUXEDO_BRAND_ID
- src/lib/water-log/session.ts     — cookie name constants + shared types
                                      (FieldSession, AdminSession, FieldSessionAuthed,
                                      FieldSessionResult). Safe to import from client
                                      components.
- src/lib/water-log/session-server.ts — server-only cookie I/O helpers
                                          (setSessionCookie, clearSessionCookie,
                                          readSessionCookie).

MODIFIED:
- src/lib/water-admin-pin-auth.ts   — re-export TUXEDO_BRAND_ID, use helpers
- src/actions/water-log/auth.ts     — use shared cookie constant + types
- src/actions/water-log/field.ts    — drop local TUXEDO_BRAND_ID copy
- src/app/api/water-photo-upload/route.ts — use shared cookie names
- src/components/water/mobile/MobileWaterApp.tsx — drop local
                                                    TUXEDO_BRAND_ID copy;
                                                    use string ops over
                                                    regex for cookie peek.

FieldSession retains its union shape (back-compat) — FieldSessionAuthed
is the narrowed success branch.

src/components/water/mobile/MobileWaterApp.tsx

@@ -39,8 +39,8 @@ import { MobileWaterPinScreen } from "./PinScreen";
 import { MobileWaterHeadgateList } from "./HeadgateList";
 import { MobileWaterLogForm } from "./LogForm";
 import { MobileWaterSuccessScreen } from "./SuccessScreen";
-
-const TUXEDO_BRAND_ID = "64294306-5f42-463d-a5e8-2ad6c81a96de";
+import { WL_SESSION_COOKIE } from "@/lib/water-log/session";
+import { TUXEDO_BRAND_ID } from "@/lib/water-log/brand";
 
 export function MobileWaterApp() {
   const [screen, setScreen] = useState<Screen>("pin");
@@ -79,7 +79,9 @@ export function MobileWaterApp() {
   //    so SSR markup matches (avoids hydration warnings). ────────
   useEffect(() => {
     if (typeof document === "undefined") return;
-    const hasSession = document.cookie.match(/wl_session=([^;]+)/);
+    const hasSession = document.cookie
+      .split(";")
+      .some((c) => c.trim().startsWith(`${WL_SESSION_COOKIE}=`));
     if (!hasSession) return;
     // Wrap setScreen in a microtask so the call doesn't fire
     // synchronously inside the effect body.