Task: session and boot region on v2 — session route, boot embeds session, ui/ useSession, translations, arrangement, notifications

Ticket of Desk v2 — REST API v2 everywhere. The shape is fixed in the session and boot grilling's resolution; do not re-open it. Wrapper: @framework/ui/api (PR #42947). Skills: /frappe-app-dev + /code-style for code, /quality-code-review in a fresh subagent before closing.

Question

Move the session and boot region onto v2 as ruled. Two PRs:

1. Framework half on develop: GET /api/v2/session in frappe/api/v2.py returning user (name, full_name, user_image, email), roles, lang, timezone, defaults; a Guest gets a Guest body, not a 401. Tests beside the other v2 route tests. Reaches desk-v2 by the sync map.
2. Desk and ui/ half on desk-v2:
   • frontend/src/boot.ts: boot through runMethod(..., { http: "GET" }); 401/403 from ApiError.status to the unauthorized screen; boot body gains session (the route's body) and drops top-level user, lang, sysdefaults, timezone; every other key stays; adds file_chunk_size and max_file_size. Update frappe/shell/boot.py and every boot.user / boot.lang reader.
   • ui/: export SessionKey and useSession() with a one-shot wrapper fetch fallback; the desk provides boot.session. Notifications take for_user from it, useUserRoles reads session.roles, formatDefaults reads session.defaults (no window.sysdefaults).
   • Wrapper gains getSession(), logout(), getTranslations(lang, version).
   • frontend/src/addresses.ts: the shell's address table (frappe.shell.doctypes.get_addresses?v=…) through runMethod(..., { http: "GET" }), reading data instead of message; the one-year cache header needs the GET (ruled in the remaining-functions grilling, 2026-09-18).
   • frontend/src/i18n.ts: translations via the wrapper, still fire-and-forget. frontend/src/shell/session.ts: logout(). frontend/src/arrangement.ts: runMethod, get as GET.
   • Notifications: rows via the list route, badge via the count route, mark-one-read as a PATCH with read: 1, mark-all and hide-indicator as runMethod, avatars as a User list. Pulse config as runMethod.

Done when both PRs are merged, no /api/method literal or frappe-ui fetch primitive remains in the files above, and the review gates ran.