fix(webui): cancel active turn before deleting sessions

[chengyongru]

Summary

• await the existing AgentLoop.discard_session() lifecycle before deleting a WebUI session
• prevent cancelled turns from restoring and re-saving a session after deletion
• fail closed when session lifecycle control is unavailable
• keep deletion token-free: no consolidation or archive runs, and unarchived messages are intentionally discarded

Verification

• uv run --no-sync pytest tests/agent/test_loop_session_policy.py nanobot/channels/websocket/tests/test_websocket_http_routes.py tests/cli/test_gateway_runtime.py tests/webui/test_gateway_webui_smoke.py -q (112 passed)
• uv run --no-sync basedpyright (0 errors)
• focused ruff check (passed)
• bun run test (1044 passed)
• bun run build (passed)
• real gateway + Playwright: create session, delete from sidebar, verify absence after refresh and clean console