feat(session): add unbounded connect and linked send

[BegoniaHe]

Summary

Add /session connect / /session disconnect so an operator can pair the current session with a target UMO: unbounded forwarding plus /send without repeating the UMO.

Related issue

Fixes #186

Behavior

• /session connect <UMO> creates or replaces a 1:1 in-memory link. Incoming messages from the target are forwarded until disconnect or process restart. Requires session.watch on both sessions in the same config.
• /session connect with no argument shows the current link or usage.
• /session disconnect drops that link. Requires session.read, same as /session unwatch.
• After connect, /send [content] (including attachment-only) delivers to the linked target. /send <UMO> [content] still sends to an explicit UMO.
• Authorization is rechecked on every forward and send. One link per actor+listener; at most 16 links per actor.

Non-goals

• No persistence across restarts.
• No Dashboard or OpenAPI management.
• No change to watch TTL limits.
• No listener targeting for connect (current session only).

Implementation notes

• Links live beside watches in SessionBridgeManager (expires_at=None, no expiry task).
• envelope_from_send_event(..., target_in_header=False) strips only the /send token.
• Plugin SDK: bridges.connect / disconnect / connection / send(..., target_in_header=True).
• Bilingual command, authorization, WebUI, and plugin send-message docs updated.

Validation

uv run ruff check <touched Python>
uv run ruff format <touched Python>
uv run pyright --project pyrightconfig.quality.json <touched Python>
uv run pytest tests/unit/test_message_protocol.py tests/unit/test_builtin_command_extensions.py tests/unit/test_import_boundaries.py::test_builtin_commands_do_not_import_astrbot_core_at_runtime --test-profile blocking

95 focused pytest cases passed. make check and full pytest were not run.

Compatibility and risk

• /send still accepts an explicit UMO; omitting it only works after connect.
• SessionWatch.expires_at is now float | None. Unbounded links report remaining_seconds=0; check expires_at is None.
• Links disappear on restart, same as watches.

Checklist

• A Feature request Issue exists for large work, or this is a small, obvious addition.
• The change is focused and does not include unrelated refactoring.
• I added or updated tests, or explained why tests are not practical.
• User-visible behavior updates both docs/zh/ and docs/en/.
• OpenAPI, generated client, docs/public/openapi.json, and tests change together when routes or schemas change.
• No secrets committed. Runtime Python deps update pyproject.toml, requirements.txt, and uv.lock together.
• I did not restore legacy shims, Python <3.14 fallbacks, or upstream publish/docs URLs as fork artifacts.
• Breaking API or behavior changes use ! and a BREAKING CHANGE: footer.
• I will not merge this PR myself. Merge needs a human maintainer review plus a separate AI-assisted review (AI_POLICY.md).
• AI use follows AI_POLICY.md. Keep exactly one author note below. Do not fabricate the other.

Agent note

Goal: give operators an unbounded 1:1 session link that forwards the target and defaults /send to it, without persisting across restarts or adding a Dashboard.

Paths: astrbot/core/platform/session_bridge.py, message_projection.py, plugin_context.py, builtin session commands and i18n, bilingual docs, focused unit tests.

Checks actually run: ruff on touched Python; pyright on touched Python; 95 focused pytest cases. Did not run make check or full pytest.

Residual risk: links are in-memory; expires_at type widened; markdownlint was not run because the local CLI binary was missing.

Tools: opencode / grok-4.6, local source, ruff, pyright, pytest, gh. Followed AGENTS.md, AI_POLICY.md, .agents/shared/conventional-commit/REFERENCE.md, and .agents/shared/ai-contribution/REFERENCE.md.

[xero-team-bot]

⚠️ This PR conflicts with its base branch and needs a rebase.

git fetch origin master
git rebase origin/master
# after resolving the conflicts
git push --force-with-lease

The needs-rebase label is removed automatically once the conflicts are gone.
(Xero-Team/AstrBot · detected by xero-bot)

[xero-team-bot]

✅ Conflicts resolved; removing the needs-rebase label.