feat(web): add safe persisted session deletion

[testikun]

Problem

Related to #347. Web Workbench can archive Sessions but cannot safely remove a persisted non-active Session. Deletion must not be confused with archive metadata removal, and the active Session must never be deleted.

Value

Adds a bounded, auditable persistence-management primitive for Session retention while keeping Pi JSONL files authoritative and preventing accidental active-session loss.

Approach

• Add an authenticated DELETE /api/sessions?path=... endpoint.
• Resolve the target from the canonical Pi Session projection and require a .jsonl file inside the configured Web Session directory.
• Reject the active Session with an explicit 409 SESSION_CONFLICT response.
• Remove the persisted file first, then clean Web-owned archived and ungrouped derived indexes.
• Publish a session_deleted event for connected clients.
• Keep native confirmation/UI, archive browsing, historical editing, and fork semantics out of this backend-only slice; those remain separate lifecycle work.

Validation

• Focused Node tests: 34 passed, 0 failed.
• Full Node/Vitest suite: 1339 passed, 1 skipped, 0 failed; Vitest 30 passed.
• biome format / biome lint --error-on-warnings: passed.
• tsc --noEmit: passed.
• Config-contract, discipline-ledger, and Web syntax checks: passed.
• Ablation: removing the typed deletion-conflict error caused the active-session API regression to return 500 instead of the required 409; the error boundary was restored.
• bun is not installed in this environment, so the equivalent repository scripts were run with the bundled Node 24 executable and local Biome/Vitest binaries.

Impact

• User-visible behavior: backend deletion API and deletion event; no UI changes in this PR.
• Model-visible context/tools: none.
• Runtime/lifecycle: active Session deletion is rejected; non-active persisted files are removed.
• Persisted data: targeted JSONL file is deleted and Web-owned index entries are cleaned.
• Compatibility/risk: endpoint is authenticated and exact-target bounded; native confirmation remains a required follow-up before exposing this mutation in UI.

[tt-a1i]

Exact-head review: persisted Session deletion is valuable, but two blockers remain. Focused adapter/host tests passed 42/42. An additional probe using the real PiWebRuntime activation/retention methods, real Pi SessionManager files, and PiWebAdapter reproduced deletion of a still-streaming background Session and loss of its original history. The fake agent lifecycle seam follows existing runtime tests; no provider call or installed UI acceptance is claimed. The destructive endpoint also omits the native reviewed confirmation required by #347. No source changes or merge performed.

[testikun]

Fixed and pushed as 6e148f7 (merged latest main).

• Added runtime lifecycle ownership checks covering active, retained, and candidate Session runtimes before deletion.
• DELETE now requires reviewed confirmation bound to the exact canonical persisted Session path; bare/wrong confirmations fail closed.
• Added adapter/host regressions for retained-runtime protection and exact confirmation.
• Validation: Node 24 focused Web adapter/host tests passed; bun run check typecheck/lint/format/build passed.

[tt-a1i]

Reviewed exact head 7e16465.

This backend deletion primitive is valuable, and the retained-runtime guard is an improvement, but two P1 lifecycle blockers remain:

• [P1] The live-Session ownership check and unlink are not atomic. deleteSession() samples isSessionOwned(...) and later calls rm(), while Session selection/creation is serialized through a different controller-mutation boundary. A concurrent select can acquire the target after the check and before unlink, so a file can become live and then be deleted. Admission and deletion need to share the authoritative runtime lifecycle boundary, with an interleaving test.
• [P1] confirm= is only caller-supplied path echo, not the native reviewed confirmation required by #347. Any authenticated API caller can send it in the same request; there is no independently reviewed, fresh, one-shot grant.

There are also P2 failure-semantics gaps: the file is removed before archive/workspace metadata updates, so a later write failure can return 500 after irreversible deletion without publishing session_deleted; missing/corrupt/repeated-delete cases also collapse to generic 500 and remain untested.

Required CI is green, but these are runtime safety invariants, so this should not merge yet.

[testikun]

更新已推送至 ef8f383。已解决 runtime lifecycle P1：PiWebAdapter 的 Session discovery、live-owner check 和 unlink 现在在 PiWebRuntime 的 controller-mutation 串行边界内执行，switchSession/newSession 不能在检查与删除之间取得目标。验证：pi-adapter 18/18、web-host 28/28 通过。

未解决且不应绕过：当前 Web host/Pi runtime 没有独立、fresh、one-shot 的 native reviewed confirmation primitive；confirm=path 的调用方回显，或由同一 API 调用方取得的 token，都不能满足该要求。该 PR 与当前 main 仍有 Adapter/Host 冲突，且在没有该原语前不应合并。需要先确定 native review grant 的所有者、UI 触发与一次性消费边界，再完成该部分和冲突重放。

[tt-a1i]

审查提交：ef8f3837a87d669453be278ac640adcd40395761。

需要修改后再合并。

具体问题

P1 — 原生审核确认被等值路径参数替代 · web/host/web-host.ts:535

DELETE accepts confirm equal to canonical path and immediately deletes; current Issue #347 requires native reviewed confirmation. Existing endpoint tests demonstrate deletion using only echoed path.

P2 — 删除成功后元数据持久化失败会返回失败且没有删除事件 · web/adapter/pi-adapter.ts:330

await rm(canonical) precedes archive/workspace metadata writes; any subsequent write error propagates before session_deleted publication. Source-level partial-failure path; no injected I/O failure reproduction.

验证范围

Full production/test diff reviewed; 46 adapter/host tests pass. Production runtime serializes deletion against controller mutations, addressing earlier selection race.

限制与后续

No native confirmation flow or browser deletion acceptance. Partial metadata failure is source evidence only.