feat: add cross-device primary session resume with continue prompt

[Copilot]

Description

Cross-device switches were starting empty chats because history/session state was scoped to userId + tabId. This change introduces a per-user primary session pointer and a resume-offer flow so a new device can continue the most recent conversation.

• Server: primary session metadata + offer flow

  • Added setPrimarySession() / getPrimarySession() to chat state store.
  • Persisted per-user primary metadata (tabId, sdkSessionId, model, mode, updatedAt) and refreshed it on message/session activity.
  • On WS connect, when current tab has no history, server checks recent primary session and emits primary_session_available with restorable history.

• Protocol + conflict signal

  • Added server message types:
    • primary_session_available
    • session_taken
  • Added session_taken emit when another device is actively processing the same SDK session.

• Client UX + behavior

  • Added ContinueSessionBanner.svelte.
  • Extended chat store with primary-session availability state + transient session-taken notice.
  • Updated page flow:
    • auto-resume on fresh devices with no prior local chat activity,
    • show continue banner on known devices,
    • delay auto-new-session briefly to allow primary-session offer to arrive.

• Tests

  • Extended unit coverage for primary-session persistence and chat-store handling.
  • Extended Playwright websocket helper to inject connect-time server events.
  • Added E2E coverage for:
    • banner rendering for known devices,
    • auto-resume for fresh devices.

// server -> client on connect (when local tab has no history)
{
  type: 'primary_session_available',
  tabId,
  sdkSessionId,
  model,
  mode,
  updatedAt,
  messages
}

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• ♻️ Refactoring (no functional changes)
• 📝 Documentation
• 🔧 CI/Build/Infrastructure
• 🔒 Security fix

Testing

• I have added/updated unit tests for my changes (npm run test:unit)
• I have added/updated E2E tests if this changes UI behavior (npx playwright test)
• All existing tests pass
• I have tested on all 3 device profiles (desktop, mobile, iPhone) if UI changed
• I have updated docs/TEST-MATRIX.md if this PR adds or modifies a feature

Quality Checklist

• My code follows the project conventions (TypeScript strict, Svelte 5 runes, factory functions)
• I have run npm run check with no new errors
• I have run npm run build successfully
• Self-reviewed my own code for clarity and correctness
• Added comments only where the code needs clarification
• No console.log or debug code left in

Security (for public repo)

• No secrets, API keys, or credentials in code or comments
• No references to private repos, internal infrastructure, or deployment details
• Input validation added for any new user-facing inputs
• XSS prevention maintained (DOMPurify for HTML rendering)
• SSRF protection maintained for any new URL inputs

Screenshots / Recordings

• Continue session banner screenshot captured: /tmp/continue-session-banner.png