Establish an attendee session

The MVP now persists attendee identity, orders, and issued entitlements in a signed cookie. Use attendee@filmfest.local to enter the festival.