…t session identifier usage

- Add shutdown() method to AgentManager to properly abort cleanup task
- Store AbortHandle for cleanup task to enable graceful shutdown
- Add test for graceful shutdown behavior
- Document session::Identifier enum variants to clarify usage:
  - Name(String): standard session operations (99% of cases)
  - Path(PathBuf): direct file access for testing/migration
- Make spawn_cleanup_task async to properly store abort handle
- Add shutdown method to AppState (marked as dead_code until server shutdown is implemented)

These changes address PR review concerns about cleanup task lifecycle
and session identifier API clarity without breaking existing functionality.

- Adapt to middleware-based authentication from PR #4338
- Remove verify_secret_key in favor of middleware auth
- Update AppState initialization to match new signature
- Preserve all Agent Manager functionality for per-session isolation
- Keep graceful shutdown improvements for cleanup task
- Fix test compilation issues with RawTextContent meta field

This completes the Agent Manager POC addressing Discussion #4389:
- Each session gets its own isolated agent
- Extensions don't interfere between sessions
- Cleanup task manages memory with graceful shutdown
- Foundation laid for scheduler/recipe integration