Expose session branch and workspace path in JSON

[nic-kahuna]

Summary

• expose the persisted session branch and workspacePath through the curated session API view
• include both optional fields in ao session get --json and session/orchestrator list JSON
• regenerate OpenAPI and frontend TypeScript schema artifacts

Semantics and privacy

This is an additive, read-only response change. Both values are omitted when empty; the API does not derive a path, probe filesystem existence or cleanliness, or change persistence/lifecycle behavior. No database migration is required.

workspacePath is an absolute local managed-worktree path. It will therefore be visible anywhere the same session API is visible, including an explicitly enabled password-authenticated LAN/mobile listener. That tradeoff is intentional for this operational source line so cleanup/reporting tools can identify the exact workspace. Prompt text, runtime handles, native agent session IDs, and the full metadata object remain filtered from the public session view.

Verification

• npm run api
• cd backend && go test ./internal/httpd/controllers ./internal/httpd/apispec ./internal/cli
• cd backend && go test -race ./internal/httpd/controllers ./internal/cli
• cd frontend && npm run typecheck
• npm run lint

The first repository-wide lint attempt hit the existing three-second timeout in TestAuthStatusUnknownWhenKeyOnlyComesFromInteractiveShell; the test passed independently immediately afterward, and the complete lint/test gate passed on rerun with zero lint issues.

No issue is linked because issues are disabled in this fork.