feat: add cloud task session client

[haitaopanhq]

Summary

• add an injectable Bridge-hosted task-session API client for the frozen /api/v1 session routes
• persist the local TaskThread key to {cloudSessionId, namespaceId, lastEventSeq, snapshotVersion} binding without changing the TaskThread/UI schema
• load the authoritative snapshot and replay ordered events; retry once with a fresh snapshot when a sequence gap is detected
• document the new runtime-only recovery and execution boundary

Why

Web and Desktop need a stable cloud session identity and replay cursor before the existing App controller can safely switch from local drafts to shared sessions. This PR establishes that TDD-tested client boundary while leaving the running XWorkmate UI and execution path unchanged until the Bridge endpoints are deployed.

Contract and security boundary

• host: injected Bridge origin; no Accounts host is hardcoded
• routes: namespace session create, session snapshot, after_seq event replay, and nested message/task-run receipt
• remote Bridge origins require HTTPS; explicit loopback HTTP remains available for local testing
• authorization is owned by the injected transport; bindings contain no token, endpoint, message, or artifact payload
• response parsing follows the frozen camelCase schema without legacy envelope/key fallback

Validation

• flutter test test/runtime/session_sync_contract_test.dart test/runtime/task_session_api_client_test.dart test/runtime/task_session_binding_test.dart test/runtime/task_session_sync_service_test.dart test/runtime/task_thread_store_test.dart (34 passed)
• flutter analyze (passed)
• security search baseline completed; no credential was added or persisted
• full flutter test was attempted and exposed six existing Mobile assistant page/golden finder failures in files untouched by this PR; serial rerun reproduced the same failures

Follow-up dependency

After the Bridge /api/v1 routes are deployed, a separate controller slice must inject the existing managed Bridge endpoint/authorization resolver and apply TaskSessionSyncResult to the current TaskThread state. This PR intentionally does not auto-call unavailable endpoints and does not modify widgets, navigation, or golden files.