feat(webui): add session collaboration via mentions

[chengyongru]

Summary

• give each persisted WebUI session a stable, server-owned @name without exposing raw session keys to the agent
• extend the existing composer mention picker so users can select peer sessions, with stable identity colors and current-tab peers prioritized
• expose self and explicitly mentioned peers in runtime context, then let agents enqueue independent peer turns through message(to="@name", content="...")
• persist incoming peer provenance in transcripts and render it separately from human messages
• keep peer execution isolated from slash commands, human-turn routing side effects, source workspace metadata, and source final-response suppression

Delivery and lifecycle

Peer delivery is asynchronous: tool success means the target turn was accepted into a bounded process-local queue, not that it completed. Busy targets process peer turns independently in FIFO order.

This change also binds peer, automation, background persistence, and WebUI outbound work to a SessionManager generation. Deleting and recreating a session cannot let stale work revive the deleted session or transcript.

UX details

• plain typed @text remains ordinary text; only a structured picker selection creates a peer mention
• the picker excludes the current session and sessions outside the active workspace
• mention identity survives refresh and remains consistent across devices
• temporary chats do not advertise peer collaboration
• queued prompts revalidate peer identities before sending
• no advanced collaboration topology screen is introduced; users and agents compose flexible topologies through ordinary mentions and messages

Validation

• affected backend suite: 719 passed
• full WebUI suite: 69 files / 1056 tests passed
• ruff check nanobot tests: passed
• basedpyright: 0 errors, 0 warnings
• WebUI ESLint: passed
• TypeScript + Vite production build: passed
• isolated gateway/browser refresh persistence: passed with a clean console and complete runtime cleanup
• independent candidate review: no P0/P1 publication blocker

Manual browser verification covered a persisted /model turn, sidebar and thread hydration after refresh, a clean console, and runtime cleanup.

Current limitation

Peer delivery is best-effort and process-local in this first version. Accepted peer turns are not durable across a gateway restart.

Related

This PR includes a generation-bound form of the session-deletion lifecycle handling explored in #5357. If this PR lands, that narrower PR is superseded.