feat(web): expose bounded runtime diagnostics

[seekskyworld]

Problem

Implements the read-only diagnostics slice of #348. Web users had no bounded way to inspect the active runtime, Session identity, workspace selection, or current model.

Value

Support can distinguish runtime and Session configuration without exposing credentials or transcript data.

Approach

Add authenticated GET /api/diagnostics returning Node version, canonical runtime cwd, active Session id, workspace selection, and current model summaries. Provider credentials and secrets remain outside the projection.

Validation

• npx tsc --noEmit
• git diff --check

Impact

• User-visible behavior: adds a bounded diagnostics response for the Web workbench.
• Model-visible context/tools: none.
• Runtime/lifecycle: read-only inspection.
• Persisted config/data: none.
• Compatibility/risk: additive endpoint; provider login and setup episode remain separate work.