Add API server session control surface

[Codename-11]

Summary

Reworks the stale API Server control-surface idea from PR #8556 into a focused patch on current upstream/main.

This adds a client/session resource layer for mobile and web clients while keeping it as a thin wrapper over current upstream primitives:

• GET /api/sessions
• POST /api/sessions
• GET /api/sessions/{session_id}
• PATCH /api/sessions/{session_id}
• DELETE /api/sessions/{session_id}
• GET /api/sessions/{session_id}/messages
• POST /api/sessions/{session_id}/fork
• POST /api/sessions/{session_id}/chat
• POST /api/sessions/{session_id}/chat/stream

The implementation uses existing SessionDB and _run_agent machinery, including X-Hermes-Session-Id and X-Hermes-Session-Key semantics. It does not add a second session DB helper or a parallel agent execution path.

/v1/capabilities now advertises the session/chat surface and explicitly marks deferred areas as unsupported so clients can choose safe fallbacks.

Explicitly deferred

This PR intentionally does not implement broad admin/config control, jobs admin expansion, memory write APIs, skills/category APIs, WebRTC, provider-native realtime sessions, or realtime voice.

Verification

• python -m py_compile gateway/platforms/api_server.py
• python -m pytest tests/gateway/test_api_server.py -q -o 'addopts=' — 149 passed
• python -m pytest tests/gateway/test_session_api.py -q -o 'addopts=' — 7 passed
• Extra local sweep: python -m pytest tests/gateway/test_api_server*.py -q -o 'addopts=' — 275 passed

[Codename-11]

Closing as duplicate/noise: this was opened from an accidentally resumed local session after existing API server session/audio PRs were already open (#29302, #29364).