feat: session metadata on create/update/read

[sr07asthana]

Summary

Closes #

Changes

How was this tested?

Checklist

• I have read the contributing guidelines
• pnpm build, pnpm test, pnpm typecheck, pnpm lint:ci, and pnpm format:check pass locally
• Tests added/updated where it makes sense
• No hand-edits to generated code (packages/trueforge-sdk, .github/fern/openapi/openapi.json, docs/openapi.json) — fork PRs omit SDK regen; maintainers regenerate after merge
• Docs / .env.example updated if configuration or behavior changed

---

Note

Medium Risk
Adds a required API field and DB migrations (including a SQLite session table rebuild); behavior is additive for clients that ignore unknown fields but breaking for strict SDK consumers expecting the old session shape.

Overview
Adds caller-owned session metadata as a string map (Record<string, string>) separate from existing session custom, with validation aligned to gateway header limits (keys 1–32 chars, values ≤128, at most 50 keys).

API & core: Optional metadata on create and PATCH; metadata is required on session responses. PATCH uses full replace when metadata is sent ({} clears); omitted fields leave the map unchanged. Sessions.create defaults missing metadata to {}; SessionHandle exposes a metadata getter.

Persistence: New session.metadata JSON column (Postgres jsonb with default {}; SQLite table rebuild). Postgres and SQLite session stores read/write and validate metadata on load; in-memory store matches the same contract.

SDK/OpenAPI: SessionMetadata type and wire serialization updates across generated SDK and OpenAPI specs.

^{Reviewed by Cursor Bugbot for commit e539158. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: e539158

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-core	Patch
@truefoundry/trueforge-sdk	Patch
@truefoundry/trueforge-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c6aa107. Configure here.}

[heerambavi1998]

Please confirm the expected behaviour on PUT requests where metadata is not sent.