feat(sessions): add trash-icon delete for live and persisted sessions (T-47)

[jaesbit]

Why

T-47: no way to delete a session from the sidebar listing without opening it first. The client also never called the existing DELETE /sessions/:id endpoint, and that endpoint itself only handled live handles — a persisted-only session (idle-reaped, or from a previous server process) would 404, and even a successful live delete only detached the in-memory handle without removing the .jsonl file from disk.

Scope

• AgentBridge.deleteSession(id) (new): disposes any live handle, then resolves the session's file path (live handle's sessionFile, or a match in listAll()) and actually deletes it + its artifact dir via the SDK's SessionManager.dropSession(). Idempotent on ENOENT.
• DELETE /sessions/:id: now calls the new bridge method, 404s only on a genuinely unknown id, and broadcasts sessions_changed on success so other open tabs see the row disappear live.
• Store: disposeSession renamed to deleteSession, now also splices the id out of the persisted sessions list (previously only cleared the live cache).
• Sidebar.tsx: hover-revealed trash icon on each session row (live and persisted), with a confirm prompt before deleting.

Verification

• Server test suite: 219 pass, 0 fail (includes 4 new tests against the real SDK SessionManager in a temp dir, plus new DELETE /sessions/:id route coverage for unknown-id 404, success + broadcast).
• Server and web typecheck: pass.
• Web build: pass.