Fix dashboard session list payload size

[yalru9406-create]

Summary\n- return lightweight metadata from /api/sessions instead of full session rows\n- clamp dashboard session list limits to avoid oversized refreshes\n- add regression coverage for excluding large/private fields from list responses\n\n## Verification\n- PYTHONPATH=. venv/bin/python -m pytest tests/hermes_cli/test_web_server_sessions_api.py tests/hermes_cli/test_web_server_host_header.py tests/hermes_cli/test_dashboard_browser_safe_imports.py -q\n- live dashboard smoke: /api/sessions?limit=20 is ~7.7KB; limit=50 is ~19KB; limit=200 clamps to 100 rows / ~38KB\n- Playwright UX smoke: console errors 0, page errors 0, failed requests 0\n

[kshitijk4poor]

Thanks for digging into the session-list payload problem — the diagnosis (list rows carrying the full system_prompt blob and oversized dashboard refreshes) is real and confirmed on current main.

Closing this one because the implementation has drifted too far from current main to salvage directly:

• The allowlist projection was cut against a May-era schema and now drops fields the current desktop SessionInfo contract requires (git_branch, git_repo_root, archived, handoff_*, title, cost fields), so applying it today would break sidebar grouping and archived views.
• The branch also bundles an unrelated session-retention subsystem (session_maintenance.py, cron + CLI wiring, docs) that needs its own review and shouldn't ride along with a payload fix.

The payload fix is being consolidated from the newer PRs in this cluster (#43653's field-strip + ?full=1 escape hatch, and the SQL-level compact_rows projection so the blob is never read off disk), with credit to everyone who reported and attacked it — including this PR. Verified against main @ f64e4f4.