fix(desktop): dedupe aliased profile databases

[deniqlab]

Summary\n- Deduplicate profile targets by physical state.db before aggregating /api/profiles/sessions and /api/profiles/sessions/sidebar\n- Preserve first-seen ownership tagging and keep distinct profile databases untouched\n- Add regressions for aliased and distinct profile databases\n\n## Verification\n- python3.11 -m pytest tests/hermes_cli/test_web_server.py -k 'profiles_sessions_dedupes or profiles_sessions_keeps_distinct_profile_databases' -q\n- python3.11 -m pytest tests/hermes_cli/test_web_server.py -q\n- python3.11 -m compileall hermes_cli/web_server.py tests/hermes_cli/test_web_server.py\n- git diff --check\n\nCloses #68299

[alt-glitch]

This was generated by AI during triage.

Related to #50086: both dedupe aliased physical state.db targets. This PR additionally applies the protection to the sidebar endpoint, so these are overlapping alternatives rather than a duplicate relationship.

[teknium1]

Thanks for covering both aggregate session paths. The aliased-state.db premise is still live on current main: hermes_cli/web_server.py:4905-4942 and :5063-5090 each scan every listed profile database independently.

Problems

• The sidebar assertions added in d90a2a529e4 expect sidebar["recents"]["total"] and profile_totals. Current main returns only sessions and profiles_truncated for recents at hermes_cli/web_server.py:5104-5115; those assertions must be updated during salvage.

Suggested changes

• Preserve the physical-file dedupe for both target loops, then assert the aliased session appears once in sidebar["recents"]["sessions"] with the first profile's ownership tag.

Automated hermes-sweeper review.