feat: add durable unattended browser sessions

[gcharang]

Summary

• add durable tenant/device coordination for unattended browser leases, expiry, recovery, reconciliation, and cleanup
• add device-control and session lifecycle support across the backend, extension, connector, and protocol
• harden authority fencing, command replay, terminal retirement, and exact closure acknowledgements, including lost-fence replays
• document unattended operations and lifecycle contracts

Verification

• pnpm --filter @understudy/backend exec vitest run test/tenant-coordinator.test.ts test/device.test.ts test/service.test.ts
• pnpm --filter @understudy/backend typecheck
• pnpm --filter @understudy/backend test
• git diff --check