feat(web): add bounded transcript-aware session search

[sowen1023]

Parent

• [Roadmap] OpenPI Web：像 Codex / Kimi Code 一样的本地浏览器 Agent 工作台 #76

Problem

Web search currently filters only the bounded client snapshot by Session title and cwd. It does not search transcript content, tool evidence, archived Sessions, or Sessions omitted from the current snapshot limit.

As the number and length of Sessions grow, users cannot reliably recover prior decisions, errors, commands, or code changes.

Value

• Find relevant prior work without loading every Session into the browser.
• Keep search useful beyond the current snapshot window.
• Preserve Session files as source of truth while treating the search index as derived and recoverable.

Approach constraints

• Search must be server-side, bounded, cancellable, and workspace-aware.
• A cache/index may accelerate lookup but cannot become authoritative Session storage.
• Results retain Session, message/turn, workspace, source, timestamp, and snippet provenance.
• Enforce query length, result count, scanned bytes/files, concurrency, and time limits.
• Respect archive visibility, workspace roots, trust, and Web-vs-terminal Session access rules.
• Snippets must be safely escaped and explicitly marked when truncated.
• Corrupt, changing, or deleted Session files must degrade without poisoning the index.
• Do not send private transcript content to an external search service.

Acceptance criteria

• Search covers titles, cwd, user/assistant text, and bounded tool evidence where allowed.
• Results can include archived and compatible read-only Sessions through explicit filters.
• Result pagination/cursors remain stable enough for navigation and report invalidation.
• Every result links to the exact Session and bounded turn/message context.
• Query, time, byte, file, concurrency, and result limits are enforced and observable.
• Index rebuild/invalidation follows Session create, rename, append, archive, unarchive, delete, and external file changes.
• No result crosses an unauthorized workspace or Session source boundary.
• Large, malformed, Unicode, and adversarial transcripts are covered by tests.
• The current lightweight title/cwd filtering remains available while server search is pending.
• bun run check and bun run test pass.

Out of scope

• External/cloud semantic search.
• Making the search index a canonical memory system.
• Unbounded full-history replay to the browser.