feat(web): expose read-only terminal session history

[testikun]

Problem

Related to #347. The Web workbench has no way to discover compatible terminal/default Pi Sessions without copying them into Web storage or switching the active Web controller. This makes existing history invisible and risks conflating observer access with control.

Value

Provides a bounded, explicit read-only bridge to Pi's default Session source so users and future UI work can inspect terminal history while preserving Pi files and controller ownership as the authority.

Approach

• Add authenticated GET /api/terminal-sessions listing with bounded query, cursor, and limit validation.
• Restrict results to the currently selected, visible Web workspace and discover them from SessionManager.listAll() (Pi's default Session source).
• Add path inspection returning a bounded preview from the existing loadSessionPreviewData loader, including omission/byte evidence.
• Mark every result with source: "pi-default", origin: "terminal", and readOnly: true.
• Reject unavailable targets with an explicit 404 receipt; no copy, activation, mutation, editing, deletion, or fork path is introduced.

Validation

• Focused Web adapter/host tests: 34 passed, 0 failed.
• Full Node/Vitest suite: 1339 passed, 1 skipped, 0 failed; Vitest 30 passed.
• biome format / biome lint --error-on-warnings: passed.
• tsc --noEmit: passed.
• Config-contract, discipline-ledger, and Web syntax checks: passed.
• Ablation: removing the typed read-only-session error boundary changed missing-session responses from the required 404 SESSION_NOT_FOUND receipt to a generic 500; the boundary was restored.
• bun is not installed in this environment, so equivalent repository scripts were run with the bundled Node 24 executable and local Biome/Vitest binaries.

Impact

• User-visible behavior: new authenticated read-only terminal Session listing/inspection API; no UI changes in this PR.
• Model-visible context/tools: none.
• Runtime/lifecycle: active Web Session/controller is never changed.
• Persisted data: no Web index or Pi Session file is written.
• Compatibility/risk: output is bounded and source/read-only labeled; native UI integration remains a follow-up slice.

[tt-a1i]

The read-only terminal-history bridge is valuable, but its current discovery path introduces a P2 history-size-dependent workload on every page and preview. The inline finding was reproduced with real default Pi Session files; focused adapter/host tests pass42/42. Please correct the source-read boundary before merge. No author code was modified, and no installed/deployed performance measurement is claimed.

[tt-a1i]

[P2] Scope history discovery before reading every workspace transcript

SessionManager.listAll() without a directory enumerates all default Pi workspaces; its buildSessionInfo reads each whole JSONL and retains allMessagesText. Filtering by the current workspace and slicing the page afterward does not bound that work. getReadOnlyTerminalSession at line488 repeats the same scan before the bounded preview loader. Reproduction with one target Session plus ten unrelated workspace Sessions of512KiB each: list(limit=1) and then preview each independently load11 Sessions, including10 unrelated workspaces, and retain5,242,886 message characters while returning only one row/two preview messages. Every page and preview therefore scales with all personal history and has no source-byte/time/cancellation bound. Restrict discovery to the selected workspace before loading transcripts and keep lookup/preview work bounded and cancellable; add coverage proving unrelated workspace files are not parsed for this route.