perf(mcp,monitor): share paginated session summaries and lazy transcript loading

[eric-tramel]

Summary

MCP and the Monitor should use the same repository operation to list sessions. That operation should return small summaries; it should not load transcripts before someone opens a session.

Today the Monitor asks an analytics path for up to 50 sessions and receives complete turn arrays. Every refresh can transfer transcript content for sessions the user may never open. Older sessions have no stable pagination path, and backend failure can resemble an empty store.

In #587's example, Moraine retained 425 sessions while the Monitor displayed 50 / 50.

This issue covers browsing only. Server-side Monitor search is the later #645 step.

Scope

• Add one authorized repository method and bounded session-summary model used by MCP and Monitor.
• Include only capped display metadata and counts needed by the list UI; include no transcript-sized fields.
• Use cursor/keyset pagination with filter/sort binding and has_more/next_cursor.
• Return the same summary fields and ordering for the same authorized repository inputs.
• Change GET /api/v1/sessions to return summaries and cursor metadata only.
• Load transcript pages through perf(mcp): seek canonical open pages without rescanning whole sessions #598's canonical open path only after selection.
• Update the Monitor UI for pagination, lazy detail loading, and explicit backend-error state.
• Do not restore mcp_session_directory, mcp_open_*, or a Monitor transcript cache.

Acceptance criteria

• MCP and Monitor call one session-summary repository operation and agree on fields/order for the same authorized inputs.
• A store with more than 50 sessions exposes older sessions through cursor pagination.
• Making transcripts substantially larger does not enlarge the session-list response.
• The list contains no transcript text, turns/steps, or tool payloads.
• Selecting a session loads exact content through canonical open with the same scope checks.
• Backend failure is distinct from a valid empty result.
• Active-session pagination behavior is documented and cursor/filter mismatches are rejected.

Chain

• Step 4 of 10.
• Previous: perf(mcp): seek canonical open pages without rescanning whole sessions #598.
• Next: perf(search): use one postings path without hidden ranking retries #597.