feat(web): list archived sessions

[testikun]

Problem

The Web archive lifecycle tracked by #347 can hide Session entries, and #361 adds an unarchive mutation, but there is no bounded read API that can discover archived Sessions for an archive view.

Value

Archived conversations become recoverable through a stable, searchable projection without copying or rewriting canonical Pi Session data.

Approach

• Reuse Pi SessionManager metadata and the existing archived-sessions.json set as the only sources of truth.
• Add a read-only archived Session projection with a 50-item page cap, 5,000-record scan cap, and bounded normalized query.
• Use opaque cursors bound to both the last Session identity and normalized query.
• Return explicit invalid-query and stale-cursor receipts.
• Report matching rows omitted by the page and source records not scanned by the hard bound.
• Expose authenticated GET /api/sessions/archived.

This is distinct from #361 unarchive mutation work. It does not add deletion, fork, historical editing, or UI.

Validation

• bun run check
• bun run test: 1242 passed, 0 failed, 1 skipped; Vitest 30 passed
• focused adapter and Web Host tests: 33 passed
• git diff --check

Impact

• User-visible behavior: authenticated API consumers can browse archived Session metadata; no UI changes.
• Model-visible context/tools: none.
• Runtime/lifecycle: read-only bounded indexing over Pi-owned Session metadata.
• Persisted config/data: none.
• Compatibility/risk: additive endpoint and adapter method; stale cursors fail closed rather than silently skipping entries.

Related to #347.

[testikun]

CI context: both Linux Node jobs reach the pre-existing packed standalone Web CLI smoke, install the tarball, and then the server exits before announcing its origin (kill: No such process). Windows and the other checks pass. This matches the independently reproduced fresh-install peer-dependency failure tracked in #328, where npm selects Pi 0.85.0 and @earendil-works/pi-server cannot be resolved. Evidence: #328 (comment)

This PR does not change package metadata, CLI startup, or peer-dependency resolution. Its local check, focused tests, full Node suite, and Vitest suite pass as recorded in the PR body.

[tt-a1i]

The archived-history API has useful value, but two P2 pagination failures were reproduced using real Pi Session files on this exact head. Please address the inline findings and add regression tests before merge. No implementation changes were made during review. Existing focused tests pass 41/41; they do not cover these cases.

[testikun]

Fixed and pushed as ee70b28 (merged latest main).

• Archived cursors now bind to the exact Session file path instead of only the Session ID, so copied/duplicate IDs paginate without looping.
• Cursor query state uses a bounded SHA-256 fingerprint of the normalized NFKC query, keeping generated cursors replayable under the 512-byte limit.
• Added duplicate-ID, long CJK, and NFKC-expanding query regressions.
• Validation: Node 24 archived adapter regression passed; bun run check passed after formatting.

[tt-a1i]

Approved exact head ee70b28.

This is a valuable read-only archived-Session projection with no model-context, mutation, execution-authority, or Session-lifecycle change. Exact-head focused tests pass 44/44, required CI is green, and the current-main merge-tree is clean.

Remaining P2/P3 follow-ups are non-blocking under the merge policy: generated cursors can be unreplayable for very long paths; activity-order changes can silently skip an item; the projection omits source/origin/controller/readOnly; the 5,000 cap is after Pi listAll I/O; and the route is not GET-only. Please track these as follow-up correctness/acceptance work.