fix: recover dashboard chat sessions after token rotation

[mfaiz-007]

Summary

• Recover dashboard chat sessions after dashboard token/session-token rotation.
• Store and resume the durable SessionDB id instead of the short in-process TUI gateway sid.
• Resolve resume targets before PTY spawn, guard stale/invalid sessionStorage, and fall back to the latest valid server-side session.
• Harden dashboard PTY attach failure cleanup so a dropped socket during replay does not leave the PTY attached to a dead WebSocket.

Tests

• scripts/run_tests.sh tests/test_tui_gateway_server.py::test_session_info_exposes_persistent_resume_session_id tests/test_tui_gateway_server.py::test_session_most_recent_returns_first_non_denied tests/test_tui_gateway_server.py::test_session_most_recent_returns_null_when_only_tool_rows tests/test_tui_gateway_server.py::test_session_most_recent_folds_db_exception_into_null_result tests/test_tui_gateway_server.py::test_session_most_recent_handles_db_unavailable tests/hermes_cli/test_web_server.py::TestWebServerEndpoints::test_get_most_recent_session_filters_internal_and_empty_rows tests/hermes_cli/test_web_server.py::TestWebServerEndpoints::test_get_sessions_defaults_hide_cron_and_empty_sessions tests/hermes_cli/test_web_server.py::TestPtyWebSocket::test_attach_failure_detaches_dead_websocket tests/hermes_cli/test_web_server.py::TestPtyWebSocket::test_channel_disconnect_keeps_pty_alive_for_reconnect tests/test_hermes_state.py::TestCompressionChainProjection::test_resumable_only_includes_empty_compression_root_with_message_tip tests/test_hermes_state.py::TestCompressionChainProjection::test_resumable_only_does_not_count_empty_orphan_compression_root ✅ 11 passed
• npm --prefix web run build ✅
• git diff --check ✅ for the focused branch diff before push

Notes

• npm --prefix web run lint currently reports unrelated existing repo-wide lint errors outside this focused change set, so it is not used as a pass/fail signal for this PR.

[teknium1]

Thanks for pursuing durable dashboard recovery. The underlying issue remains relevant, but this draft predates the current keep-alive PTY registry and needs a focused transplant.

Problems

• Current main attaches through hermes_cli/web_server.py:15464 and replays buffered bytes after setting the socket in hermes_cli/pty_session.py:88-93. A replay-send exception can leave the dead socket marked attached. The draft's _DashboardPtySession cleanup targets a replaced architecture, and git apply --check shows the patch no longer applies.
• The draft's latest-session recovery is not profile-scoped. Current descendant lookup carries the management profile in web/src/lib/api.ts:362-367; recovery must preserve that boundary.
• The added non-secret dashboard HERMES_* tuning variables conflict with the repository configuration policy; use existing behavior or config.yaml-backed settings.

Suggested changes

• Salvage the replay-failure cleanup and regression test against PtySessionRegistry.
• Rebuild durable resume around the current profile-scoped APIs and attach-token flow.

Automated hermes-sweeper review.

[teknium1]

Please do not add behavioral configuration through a new non-secret HERMES_* variable. Dashboard PTY limits should remain fixed or be exposed through the config.yaml mechanism; this PR's recovery fix should not introduce an env-var configuration surface.

[mfaiz-007]

Thanks for your reply.