feat: expose session recovery audit and safe repair endpoints

[ai-ag2026]

Summary

• Expose a read-only GET /api/session/recovery/audit endpoint for the recovery audit report.
• Add POST /api/session/recovery/repair-safe to run the same deterministic repairs as startup recovery and return before/after audit evidence.
• Extend python -m api.session_recovery with --repair-safe for CLI repair runs.

Stack

Builds on #2036, which builds on #2035. GitHub may show the earlier commits in this PR until the base PRs land or the branch is rebased.

Safety model

• Safe repair only restores shrunken/orphan .json.bak snapshots that the startup recovery path already handles.
• Orphan backups without a canonical state.db.sessions row remain manual-review cases.
• The endpoint returns 409 when repairable/unsafe findings remain instead of pretending everything is fine. A rare feature in software: honesty.

Test Plan

• python -m pytest tests/test_session_recovery_api.py tests/test_session_recovery_audit.py tests/test_metadata_save_wipe_1558.py -q -o 'addopts='
• python -m py_compile api/session_recovery.py api/routes.py
• git diff --check
• added-line security scan: clean

[nesquena-hermes]

Shipped in v0.51.42 (Release R) via stage #2049 — thanks @ai-ag2026!

Live-fire verified end-to-end: hand-crafted state.db with a webui-source row + missing sidecar; GET /api/session/recovery/audit correctly reports state_db_missing_sidecar / repairable; POST /api/session/recovery/repair-safe returns the honest 409 with full before/after audit evidence when audit findings remain post-repair.

Release notes: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.42