Session management architecture overhaul

[joelteply]

Problem

Session/identity management is fragmented and brittle:

• Browser sessions go through a different path than CLI sessions
• userId scattered across widgets instead of connection-level
• DEFAULT_USERS.HUMAN (deterministic UUID) doesn't match actual DB user IDs
• Anonymous sessions created then upgraded — race conditions everywhere
• Session files persist stale state across reboots

Needed

• Single session creation path for all client types
• userId resolved ONCE at connection time, auto-injected into every command
• No hardcoded user constants in widgets
• Clean session lifecycle: create → active → destroy (no upgrade dance)
• Session state survives server restart gracefully

[joelteply]

Substantially addressed by PR #315 (multi-tower session identity) and PR #346 (seed-before-connect fix). Remaining items (stale session cleanup) tracked separately.