perf: improve session, file, and interaction performance

[lyx2145181]

Summary

This PR consolidates the Pi Web performance, reliability, and interaction improvements developed on top of v0.9.0.

Session performance and history

• Add a fingerprinted incremental session index with bounded persistence and worker reconciliation.
• Add bounded session-detail/context caches and numeric history paging.
• Preserve full-branch statistics while loading history incrementally.
• Improve session-list refresh ordering, compression, and runtime reconciliation.
• Cancel stale requests and guard asynchronous responses with generations.

File, Viewer, Git, and Worktree performance

• Add opaque file versions shared by reads, watchers, media, downloads, and previews.
• Use watcher-first file handshakes and bounded content/document-preview caches.
• Reuse Git snapshots and limit Git subprocess concurrency.
• Add directory-version batch validation and reduce unnecessary Viewer re-renders.
• Keep file and worktree authorization checks before cache reuse and conditional responses.

UI and interaction improvements

• Preserve session tree collapse state.
• Support pinned-session ordering and improve sidebar refresh feedback.
• Improve session switching, loading states, file tree refresh, File Viewer, and Diff interactions.
• Keep project and Worktree identity consistent across the sidebar and file operations.
• Add Server-Timing and repeatable session/browser performance baselines.

Runtime reliability

• Serialize extension-aware SDK service loading.
• Prevent transient model discovery from consuming extension singletons without lifecycle cleanup.
• Improve Agent/session lifecycle handling and background-work protection.
• Keep workspace and project-trust behavior resilient when directories disappear.

Scope

• Based on the latest upstream/main (v0.9.0).
• Internal planning documents and generated AGENTS.md changes are excluded.
• The LAN-default behavior change is intentionally excluded because it changes deployment defaults and should be reviewed separately.

Validation

• npm test — 1079 passed
• node_modules/.bin/tsc --noEmit
• npm run lint
• git diff --check

The implementation preserves Pi's JSONL/SDK authority and keeps authorization checks independent from derived caches.