perf: resolve session paths without full catalogue scans

[Shujakuinkuraudo]

Summary

• resolve valid session IDs by enumerating only default session-storage filename candidates and validating a bounded session header
• populate the existing forward and reverse path caches on a validated hit
• resolve in-storage parent paths from their bounded header, avoiding a second catalogue scan while loading session details
• preserve the current full-catalogue fallback for missing, malformed, ambiguous, or non-standard session layouts

Relationship to existing work

Related to #513.

#516 independently implements the targeted saved-session lookup described by suggestion 1 in #513. This PR follows the same safety boundary — the filename is only a hint, the bounded header ID is proof, and misses retain the existing full-catalogue fallback — and additionally:

• populates both existing path caches after a validated hit
• supports the reverse path-to-session-ID lookup
• avoids another catalogue scan when resolving an in-storage parentSession path

This PR deliberately does not change the initial SessionManager.listAll() metadata scan. That is suggestion 2 in #513 and is better addressed in the Pi SDK than by duplicating session parsing in Pi Web.

Validation

• node --experimental-strip-types --test lib/session-reader.test.mjs app/api/sessions/runtime-route.test.mjs
• npm test (591 passed)
• node_modules/.bin/tsc --noEmit
• node_modules/.bin/eslint .
• npm run build
• git diff --check

AI assistance

OpenAI Codex was used to investigate the session-resolution path, implement the change, add regression coverage, and run the validation commands. The resulting diff was independently reviewed before submission.

[Shujakuinkuraudo]

Follow-up hardening is now pushed: targeted and catalogue session paths are canonicalized and constrained to the physical default sessions root, including project-symlink escape coverage. The focused session-reader tests (20), changed-file ESLint, and TypeScript check pass.