Topic/upstream session lifecycle 20260412

[everett4320]

Summary

This PR fixes multi-provider session lifecycle stability and performance issues on topic/upstream-session-lifecycle-20260412, while keeping full provider support (claude/cursor/codex/gemini/openrouter/local/nano).

Key outcomes:

• New session appears in sidebar immediately after first message.
• Multi-session concurrent switching no longer stalls for minutes.
• Session/message routing no longer cross-talks across provider/project scopes.
• Invalid project owner fallback prevents FOREIGN KEY constraint failed noise.
• Backward compatibility preserved for existing projects with large historical sessions.

Root Causes Addressed

1. Realtime routing used sessionId in several paths instead of consistently using actualSessionId ?? sessionId.
2. Session UI identity relied on session.id only, which is insufficient in multi-provider / multi-project contexts.
3. Session loading stale-guard could drop valid responses; clear-then-load behavior caused temporary blank sessions.
4. Codex session lookups repeatedly rescanned ~/.codex/sessions, causing heavy latency under concurrent usage.
5. Invalid ownerUserId in config could violate DB FK constraints.

What Changed

Frontend

• Added optimistic session insertion flow for sidebar (OPTIMISTIC_SESSION_CREATED_EVENT) with scoped dedup identity project::provider::sessionId.
• Unified identity keys in sidebar/workspace selection/editing paths.
• Hardened session activity/progress tracking with scoped keys.
• Unified realtime routing to actualSessionId ?? sessionId.
• Added scoped filter debug plumbing (disabled by default).
• Improved session loading:
  • provider resolution priority: session-bound -> active provider -> persisted provider -> inferred -> default
  • skip history loading for temporary IDs (new-session-* / temp-*)
  • generation-based stale request guards to prevent late response overwrite
  • safer cache candidate keys:
    • keep project+session(+provider) compatibility
    • remove legacy project-only fallback to avoid cross-session replay

Backend

• Added Codex session-created event builder including projectName.
• Unified Codex session file resolution path across message loading and token usage.
• Added Codex session file path cache + index cache (with invalidation on deletion).
• Added ownerUserId validation/fallback to authenticated/valid user to avoid FK errors.

Compatibility

• No provider restrictions introduced.
• Existing historical projects/sessions remain supported.
• No external API breaking changes.

Verification

Automated

• npm run typecheck ✅
• npm run test -- --run --maxWorkers=1 ✅
• Result: 19 passed files / 110 passed tests

Manual smoke

• First message in new session appears in sidebar immediately.
• 2-3 concurrent sessions across providers can run and switch without minute-level wait.
• Existing historical projects/sessions load without cross-session leakage.