refactor(go): shared endpointsvc resolution layer

[rado0x54]

What

Review item 2: the demo-aware endpoint resolution logic existed three times (rest/sessions.go, rest/endpoints.go, agent/session.go) and the endpoint field constraints twice (rest, mcp) — and the copies had already drifted once (the MCP validation gap fixed in #238). This PR gives them one home.

New package: internal/endpointsvc

• Service.ListForAccount — own endpoints first, then demo entries when the account's visibility toggle shows them (order pinned by the endpoints-list golden); returns provenance (IsDemo) so REST can render the flag and MCP can ignore it.
• Service.GetForAccount — account-scoped get; demo ids resolve regardless of toggle (a caller that knows the id can inspect it); foreign/unknown ids are an indistinguishable nil (no cross-account probing).
• Service.RefForAccount — resolves to the terminal.EndpointRef session creation consumes (previously the identical mapping lived in both rest.toRef and agent.resolveRef).
• Shared constraints — UserVerificationValues/IsUserVerification/DescriptionMaxLen, now referenced by both REST validation and the MCP patch decoder; the "duplicated until a shared endpoint service exists" copies are deleted.

Mutations stay on store.Endpoints (exposed as Service.Endpoints): demo entries are synthesized per request, never stored, and the wire layers reject demo ids before mutating.

Consumers

• rest.Endpoints/rest.Sessions drop their Store+Demo fields for Svc; resolveEndpoint/toRef deleted.
• agent.Deps becomes {Manager, Svc}; GetEndpoint/ListEndpoints/resolveRef now delegate.
• Session cap: the REST inline count moves to terminal.Manager.CountOpenForAccount, whose doc comment states the account-wide semantics and points at the deliberately-different MCP live-owned count in agent.Session — the two semantics are a documented split, not an accident, so they are named rather than unified.

Tests

• New internal/endpointsvc/endpointsvc_test.go: toggle-off list vs. get-by-id, toggle-on merge order, ref resolution for stored + demo endpoints, foreign/unknown-id nil semantics.
• All 20 Go test packages green (goldens and parity untouched — this is behavior-preserving), go vet, gofmt, pnpm spdx:check clean.

Also adds an endpointsvc bullet to docs/go-backend-architecture.md §5.5.