Reframe agent connect notice; gate it off web UI sessions

[andrew-jon-p7a]

The broker pushed a welcome message to every WebSocket subscriber the
moment its /subscribe upgrade landed. Two problems:

1. It went to web UI sessions too. A human signing in saw an ac7- from message in their chat — noise, since the dashboard already tells them they're connected.

2. The message was titled "comms check" and worded " online. N active objective(s) on your plate." Agents read that as a probe and started DMing teammates to "test" the comms surface, instead of just absorbing the context.

The intent of the notice is to give the agent's first turn enough
state to decide whether to resume work, action a new objective, or
stand by. Reframed it accordingly.

═══ Changes ═══

apps/server/src/app.ts:

- Subscribe handler now gates the push on `c.var.tokenId !== null`. That's the auth-middleware signal for opaque-bearer auth (the runner's auth path). Cookie-auth and JWT-auth subscribers no longer receive it.

- Extracted `composeSessionOnlineMessage(memberName, activeCount) → { title, body }` and exported it for unit tests. Pure; no broker / objectives store dependencies.

- New wording: title: 'ac7 session online'  (was 'comms check') body:  'Connected to ac7 as <name>. <plate>. This is a system notice marking the start of a runtime session — no acknowledgement is required. Resume any in-progress work, address open objectives, or stand by for new direction as appropriate.'

  `<plate>` renders as either "You have N active objective(s) on your plate — call `objectives_list` to see them." or "No active objectives are assigned to you right now."

═══ Tests — apps/server/test/session-online.test.ts (new, 6 tests) ═══

- 4 unit tests on the composer: empty / populated plate output, regression assertions that "comms check" never appears, and that no reply-inviting phrasing slips back in.

- 1 end-to-end via runServer + a real `ws` client: bearer-auth subscriber receives the new notice with the new title/from/to.

- 1 end-to-end via createApp + injectWebSocket against a raw node:http server, with a session minted directly through SessionStore.create (skips TOTP enrollment ceremony). Confirms a cookie-auth subscriber receives nothing from `ac7` within 1.5s. Verified by temporarily reverting the gate — this test catches it with the exact "expected null, got 'ac7 session online'" the bug produced.

Summary

What changed

Test plan

• [ ]
• [ ]

Related

Checklist

• All commits are signed off (git commit -s) — the DCO bot will confirm
• pnpm lint is clean
• pnpm typecheck is clean
• pnpm test passes
• Docs/README updated if user-facing behavior changed