feat(session): complete session command and dashboard controls

[BegoniaHe]

Summary

Close the remaining IM and Dashboard gaps on session identity, service switches, aliases, watches, and full-block.

Related issue

Fixes #184

Behavior

• /tts status|enable|disable toggles TTS for the current session. It requires session.manage and is idempotent, same as /llm.
• /session info [this|UMO] can inspect another session. An explicit UMO requires instance_operator or above and shows that session's auto name and alias, not the caller's UID or subject.
• /session name [--target UMO] [--clear] can set or clear the display alias on the current or another session.
• /session watches [listener|this] lists watches for a chosen listener session as source -> target (seconds).
• Dashboard custom-rule notes write user_alias (same store as /session name) and stop persisting custom_name on save. Leftover custom_name still displays until the next save.
• The custom-rules editor can fully block a session (session_blocked). The batch session-service API accepts the same field.

Non-goals

• No IM commands for per-session plugin or knowledge-base rules.
• No Dashboard watch manager.
• No restoration of the old argument-less /tts toggle.
• No read-time migration of leftover custom_name rows.

Implementation notes

• Cross-session target resolution is shared by /bot and /session through commands/target.py.
• Dashboard session_service_config.custom_name is copied onto umo_alias.user_alias in update_session_rule, then stripped from the stored rule.
• OpenAPI BatchSessionServiceRequest adds session_blocked. Generated client and docs/public/openapi.json were regenerated together.
• Bilingual docs updated: command, custom-rules, architecture action table, and plugin bridges.list.

Validation

uv run ruff check <touched Python>
uv run ruff format <touched Python>
uv run pytest tests/unit/test_builtin_command_extensions.py tests/unit/test_umo_alias.py tests/unit/test_message_protocol.py tests/unit/test_session_management_service.py tests/unit/dashboard/test_fastapi_v1_sessions.py tests/unit/test_session_status_check_stage.py --test-profile blocking
cd dashboard && pnpm generate:api
cd dashboard && pnpm exec vitest run tests/sessionManagementPage.vitest.ts
cd dashboard && pnpm i18n:check
prettier --write dashboard/src/api/generated/openapi-v1/**/*.ts docs/public/openapi.json <touched docs>
markdownlint-cli2 <touched docs>

176 focused pytest cases passed. Dashboard i18n check and sessionManagementPage Vitest passed. make check and full pytest were not run.

Compatibility and risk

• IM watch list text now includes the listener UMO.
• After a Dashboard service-config save, custom_name is no longer stored in session_service_config; display uses user_alias.
• PATCH /api/v1/sessions/service accepts optional session_blocked. Existing callers that omit it are unchanged.

Checklist

• A Feature request Issue exists for large work, or this is a small, obvious addition.
• The change is focused and does not include unrelated refactoring.
• I added or updated tests, or explained why tests are not practical.
• User-visible behavior updates both docs/zh/ and docs/en/.
• OpenAPI, generated client, docs/public/openapi.json, and tests change together when routes or schemas change.
• No secrets committed. Runtime Python deps update pyproject.toml, requirements.txt, and uv.lock together.
• I did not restore legacy shims, Python <3.14 fallbacks, or upstream publish/docs URLs as fork artifacts.
• Breaking API or behavior changes use ! and a BREAKING CHANGE: footer.
• I will not merge this PR myself. Merge needs a human maintainer review plus a separate AI-assisted review (AI_POLICY.md).
• AI use follows AI_POLICY.md. Keep exactly one author note below. Do not fabricate the other.

Agent note

Goal: make IM session commands and the custom-rules page cover identity, aliases, TTS, watches, and full-block on the current path, without adding plugin/KB IM commands or a watch Dashboard.

Paths: astrbot/builtin_stars/builtin_commands/, astrbot/core/platform/session_bridge.py, astrbot/core/star/plugin_context.py, astrbot/dashboard/services/session_management_service.py, dashboard/src/views/SessionManagementPage.vue, OpenAPI + generated client, bilingual docs, focused unit tests.

Checks actually run: ruff on touched Python; 176 focused pytest cases; Dashboard i18n check; sessionManagementPage Vitest; OpenAPI client/docs regeneration and Prettier; markdownlint-cli2 on touched docs. Did not run make check or full pytest.

Residual risk: leftover custom_name remains until the next service-config save; watch list text format changed; make check was not run in this session.

Tools: opencode / grok-4.6, local source, ruff, pytest, pnpm, prettier, markdownlint-cli2, gh. Followed AGENTS.md, AI_POLICY.md, .agents/shared/conventional-commit/REFERENCE.md, and .agents/shared/ai-contribution/REFERENCE.md.