Reject a second live WebSocket for the same session name.

Two tabs with the cookie already set never POST /api/session, so name-online on login did not cover the design rule. Claim the name under the same lock as the online check.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/HSchool.Simulation.Tests/ClockTempoTests.cs

@@ -34,9 +34,26 @@ public class ClockTempoTests
             school.Tick(OneTwentiethOfASecond, GameMinutesPerRealSecond);
         }
 
+        Assert.Equal(Start.AddMinutes(1), school.Clock.Time);
         Assert.Equal(20, school.HeavySystemsInvocations);
     }
 
+    [Fact]
+    public void AtX5_TwentyImpulses_RunHeavyFiveTimesAndAdvanceFiveGameMinutes()
+    {
+        using var school = School.Create(1, "Страйд ×5", Start);
+        school.Clock.SpeedIndex = 3;
+
+        for (var i = 0; i < 20; i++)
+        {
+            school.Tick(OneTwentiethOfASecond, GameMinutesPerRealSecond);
+        }
+
+        Assert.Equal(Start.AddMinutes(5), school.Clock.Time);
+        Assert.Equal(5, school.HeavySystemsInvocations);
+        Assert.Equal(1d, school.LastHeavyGameMinutes);
+    }
+
     [Theory]
     [InlineData(3, 5d)]
     [InlineData(4, 10d)]