Authentication bypass via cross-request scheduler context reuse

Race condition in Effect before 3.20.0 allows remote attackers to read or alter another user's session context through concurrent requests. MixedScheduler batches fiber continuations under the AsyncLocalStorage context of the request that started the drain, while toWebHandlerRuntime forks fibers without capturing and restoring their originating context. Exploitation requires overlapping requests in a Next.js App Router handler that invokes an AsyncLocalStorage-dependent API from an Effect fiber, enabling authentication bypass or cross-request data disclosure.