fix(terminal): finalize sessions abandoned mid-handshake so slots aren't leaked

[Farahat612]

A browser refresh/close during WS open lands in onClose while onOpen is
still awaiting the SSH channel and audit-row insert. teardown then ran
with no sessionId, marked the connection ended, and onOpen resumed to
register a session nobody owns: the idle/cap timeout's teardown became a
no-op, leaving the terminal_sessions row open forever. Since the
handshake cap counts DB rows with endedAt IS NULL, each abandoned open
permanently burned a per-user slot until a restart's closeAllActive()
sweep (#426).

teardown now defers to onOpen while no session is registered (leaving
state.closed set as the abort signal), and onOpen aborts after
registration when the WS is already gone: unregistering and finalizing
the row instead of wiring a dead connection. Park/resume after "ready"
is unchanged. Same-shape fix in the service-terminal controller.

New regression test drives the real handler bundle with onClose landing
mid-openShell: fails before (in-memory + DB counts stay 1), passes
after; a sibling test pins that post-ready disconnects still park.

Closes #426.

Root cause in one line: the WebSocket close listener is registered before
the async open handler resolves, so a browser refresh mid-handshake ran
teardown with no sessionId, marked the connection ended, and the session
registered moments later could never be finalized. The terminal_sessions row
(whose endedAt IS NULL count gates the 3-session cap) stayed open until a
restart's closeAllActive() sweep, which matches the reported "persists for
days, docker compose restart fixes it".

How verified: the new test drives the real handler bundle with onClose
landing while onOpen is suspended inside the SSH channel open. It fails on
main (in-memory and DB active counts stay 1) and passes with the fix. A
sibling test pins that a disconnect after the ready frame still parks the
session for resume, so the intentional park/resume design is unchanged. The
same-shape fix is applied to the service-terminal controller. Full apps/api
suite green (2993 tests), typecheck clean.