feat(sessions): add archive and permanent delete controls

[mttzzz]

Problem

The sessions sidebar accumulates active and persisted sessions, but offers no way to archive, restore, or permanently delete them. Each row is only an open/resume button, so stale sessions remain visible forever.

Observed on omp-deck 0.6.1.

Current behavior

• apps/web/src/components/Sidebar.tsx renders SessionRow as a single button with no row actions or context menu.
• The web store has disposeSession, but it is not exposed from the sidebar.
• DELETE /api/sessions/:id only looks up an active bridge handle and calls handle.dispose().
• Persisted sessions therefore return 404 from that endpoint, and disposing an active handle does not delete its JSONL history.
• There is no archive state or archive API for sessions.

Proposed UX

Add a … menu to every session row:

1. Archive — hide the session from the default list without deleting history.
2. Restore — available from a Show archived view/filter.
3. Delete permanently… — require explicit confirmation and clearly state that conversation history will be removed.

The menu should work for both live and persisted sessions without changing the primary row-click behavior.

Backend requirements

• Represent archive state independently of the session transcript so archiving does not rewrite conversation history.
• Support archive/restore for persisted and active sessions.
• Support permanent deletion by stable session identity, not only by an active bridge handle.
• On permanent deletion of a live session: abort/close it first, dispose the handle, then remove the persisted transcript.
• Resolve the persisted path server-side and validate it remains under the configured agent sessions directory; never accept an arbitrary client path for deletion.
• Make repeated archive/delete requests idempotent where practical.
• Refresh workspace/session counts after archive, restore, or deletion.

Acceptance criteria

• Every sidebar session row exposes an accessible actions menu.
• Archiving removes the session from the default list without deleting its transcript.
• Archived sessions can be listed and restored.
• Permanent deletion requires confirmation and removes the transcript from disk.
• Active-session deletion leaves the UI in a valid state with no stale subscription or selected id.
• Persisted sessions can be deleted without first resuming them.
• Files outside the configured sessions directory cannot be targeted.
• Server tests cover active/persisted deletion, archive/restore, idempotency, and path traversal rejection.
• Web tests cover menu behavior, confirmation, list refresh, and active-selection cleanup.

Non-goals

• Bulk retention policies or automatic expiry.
• Cloud sync/trash recovery beyond reversible archive.