Unvalidated client sessionId (spoof + undefined-sid collapse)

Severity: High · Where: collect.ts:129,131,141 payload.sid is used unvalidated in keys; when omitted everything collapses to SESSION#undefined and undefined-{path} heatmap rows. Impact: Session spoofing / cardinality inflation / count corruption. Fix: Validate sid format; reject/replace missing or malformed.