[anurag629]

F3 of the 1.0 freeze (F-04 task 15), as decided: session tokens are required by default, and allowAnonymous: true replaces requireSession: false.

Config	0.x	1.0
sessionSecrets	tokens required	tokens required
sessionSecrets + allowAnonymous: true	(was requireSession: false)	checked when sent, not required
neither	anonymous chat	refuses to start, and says to set a secret (openssl rand -base64 32) or allowAnonymous: true
allowAnonymous: true alone	n/a	anonymous chat, as 0.x did
requireSession	option	removed: a startup error that points to allowAnonymous

Code:

• packages/server/src/config.ts and security/sessions.ts: allowAnonymous replaces requireSession. The no-secrets case now throws unless allowAnonymous is set. removed-options.ts now also catches requireSession.
• packages/cli/src/test/run.ts: chatcops test passes allowAnonymous: true, since it calls the handler in process and there's no widget to fetch tokens.
• e2e/server.mjs: the plain endpoint is anonymous, and /api/secure-chat keeps requiring tokens.
• The website's own chat endpoint sets allowAnonymous: true next to its optional secret, as it did with requireSession: false.
• The three examples in packages/server/src/examples/ read CHATCOPS_SESSION_SECRET.

Docs:

• The quick start makes a secret and mounts Express with app.use. app.all('/chat') misses /chat/session, where the widget gets its token.
• The Express, Vercel, Next.js, Hono, Bun, Deno, Cloudflare and full-example pages all set sessionSecrets, and give the session path a route where one is needed.
• The AI SDK page sets allowAnonymous: true and says why: useChat doesn't fetch tokens.
• The setup page explains the default and when to use allowAnonymous, and says the short snippets on other pages leave the secret out.
• The 1.0 upgrade guide has an entry. Both READMEs are updated, and the server README's leftover conversationStore (removed in feat!: remove the APIs deprecated in 0.6 to 0.8, with an upgrade guide #441) is fixed.

Tests: 80 handler configs in the server tests that had no session setup now set allowAnonymous: true. Tests that do set up sessions are unchanged. New tests cover the startup error and its message, required for each combination, and requireSession being refused. Build, typecheck, test:coverage, lint (dev baseline), api:check (requireSession becomes allowAnonymous), publint, docs:check (146 blocks), the website build and the full e2e suite (69, Chrome) pass. Docs bot index rebuilt: replay 9 of 9, citations 49 of 50 (98%).