feat: add API server session controls

[Codename-11]

Summary

• Adds a focused /api/sessions control surface for API Server clients: list/create/read/update/delete, message history, fork, chat, and chat SSE.
• Advertises the supported session-control surface in /v1/capabilities so mobile/web clients can discover enhanced Hermes support and fall back safely.
• Keeps chat execution on the current _run_agent path and SessionDB primitives, preserving X-Hermes-Session-Id / X-Hermes-Session-Key semantics and existing /v1/runs behavior.
• Explicitly leaves broader admin/config/jobs/memory/skills/realtime voice expansion out of this patch.

Revives the product intent from stale PR #8556 without mechanically merging the stale branch.

Test plan

• python -m py_compile gateway/platforms/api_server.py
• python -m pytest tests/gateway/test_session_api.py -q -o 'addopts='
• python -m pytest tests/gateway/test_api_server.py -q -o 'addopts='

Note: local verification emits warnings from a local Hermes-Relay bootstrap monkey-patch in this environment; the targeted tests pass.

[wirwolf]

Hey. Also waiting for this feature in the next version

[sam55silver]

Also would love this feature! in general more APIs would be great to build clients on-top of hermes.

[Schwartz10]

Echoing sentiment here - would use these APIs!

[Schwartz10]

Hey @Codename-11! Just wanted to flag that I opened Codename-11#2 against your session-control branch.

It adds multimodal/image support for the new /api/sessions/{session_id}/chat and /chat/stream endpoints by normalizing input_text / input_image payloads through the existing multimodal content normalizer.

Without this, clients can send image-shaped payloads, but the new session chat endpoints pass them through without the same validation/canonicalization that /v1/responses and chat-completions already get, so image handling is more dependent on downstream adapter behavior. This makes image forwarding explicit and covered by regression tests.

[teknium1]

Merged via salvage PR #33134 — #33134

Your branch was substantially behind main (1246 files / +9.7k / −181k stale) so direct merge wasn't possible. Cherry-picked your two substantive commits onto current main, resolved conflicts with #33016 (which had just added /v1/skills + /v1/toolsets), flipped the placeholder skills_api: False → True now that those endpoints shipped, and ran a full E2E live HTTP suite against the resulting code.

Both authorships preserved via rebase merge into main:

• f7527b0fd — your base session control API
• 464b51d45 — @Schwartz10's multimodal followup

Validation done before merge:

• 7/7 of your contributor tests pass
• 165/165 full test_api_server.py
• 246/246 across all api_server-related test files
• E2E live HTTP: full CRUD lifecycle + chat + fork (parent_session_id lineage) + 401 enforcement + X-Hermes-Session-Key echo

AUTHOR_MAP entries added for both of you in scripts/release.py so the attribution check stays green for future releases. Thanks for the patient work on this — three iterations to land it (#6334 → #8556 → #29302), and the focused split you landed on is what made it mergeable. Credit to @outsourc-e for the original idea path too.