fix(web): prevent duplicate session creation

[swear01]

Summary

• claim Create Session synchronously before its first async validation
• disable the form and show creating state for the full validation/spawn operation
• ignore concurrent Create activations until the current attempt finishes
• cover the slow directory-validation double-submit race

Root cause

handleCreate() awaited checkPathsExists() before calling the TanStack spawn mutation. The mutation's isPending flag was therefore still false during directory validation, leaving Create enabled. A second activation started another handler, and both handlers independently reached /spawn.

Impact

A double-click/double-tap or repeated activation on a slow connection could start two agent processes. The shared form means this was not Codex-specific even though Codex exposed the report.

Validation

• bun typecheck — pass
• bun run --cwd web test --run src/components/NewSession/index.test.tsx — 9 passed
• git diff --check — pass
• bun run test — unrelated existing CLI integration/flaky suites fail in this long-running local HAPI environment; the changed web suite passes. CI is the clean-environment full-suite gate.

Fixes #1220

AI disclosure: Codex assisted with root-cause analysis, implementation, regression testing, and PR drafting. The diff and test results were manually reviewed.

[github-actions]

Findings
None.

Summary
Review mode: initial
No issues found in the latest diff. Residual risk: tests were not run here because the review security instructions prohibit executing code from PR content; this pass relies on diff/source inspection and the contributor-reported validation.

Testing
Not run (automation/security constraint).

HAPI Bot