fix: preserve four deployment-required compatibility fixes

[Ramadas108]

Summary

This compatibility branch preserves four narrowly scoped fixes that were required
by the operator's current Hermes deployment and were not found as exact existing
upstream PRs during the read-only search.

The branch is based on official main at
863e31318553cda8ad61df681d08175364d4164b and contains exactly four commits
over that pinned base. The fork's unrelated main branch was deliberately not
overwritten.

Included patches

1. fix(minimax): preserve auxiliary OAuth routing
   • Keeps the auxiliary MiniMax OAuth route explicit.
   • Includes tests/agent/test_auxiliary_minimax_oauth.py.
2. fix(browser): create CDP targets in background
   • Prevents focus-stealing target creation.
   • Includes tests/tools/test_browser_background_tab.py.
3. fix(cli): prevent history navigation from triggering auto_up/auto_down
   • Keeps arrow navigation from invoking unintended history transitions.
   • Includes tests/cli/test_arrow_navigation_history_guard.py.
4. fix(api): remove empty sessions created by failed API requests
   • Removes empty sessions across failed API lifecycle paths.
   • Includes tests/gateway/test_api_server_failure_session_cleanup.py.

Validation

Focused regression tests were executed on the current branch with the isolated
Python 3.12 environment:

• 23 passed, 4 warnings
• Protected SQLite 3.53.4 mapping verified separately.
• This is not a full compatibility-suite or upstream-CI claim.

Scope exclusions

This PR does not include host-specific SQLite deployment, systemd, credential,
release-pointer, or updater changes. Those remain deployment-layer concerns.

[alt-glitch]

This was generated by AI during triage.

Related: the MiniMax OAuth auxiliary-routing portion overlaps open #77419 and #40122, while this omnibus also contains separate browser, CLI, and API-session changes.