scope the six sessionKey commands to their caller

The control surface half of 7cb402b, and the code-side blocker on the gates.
kill, interrupt, clear-session, is-generating, find-session and list all took a
bare sessionKey, so any caller who could reach them could act on whichever
session happened to match — and list returned every session in the sidecar,
which host rightly called a disclosure on its own, before anyone kills anything.

All six now carry userId, resolved from the authenticated request and never
taken from the client, and every handler enforces it through one ownedSession
helper. list is filtered rather than labelled. find-session is scoped because it
is the reattach hinge: a browser holding a transcript uuid it should not have
would otherwise be handed the session key that drives it.

"Not yours" and "does not exist" answer identically everywhere, which is the
same choice getClaudeSession made: every caller treats them the same, and a
distinct answer for the second confirms to a guesser that a session exists under
a key they do not own.

One behaviour change beyond the scoping. endTurnIfAgentIsGone sweeps sessions on
a sidecar restart, and a session with no recorded userId now has no safe id to
ask as — asking as the owner would answer a member's orphaned session with the
owner's authority. It is skipped, so it stays marked generating until the next
reconnect corrects it, which is what happened before that loop existed.

This removes the code-side reason the gates cannot move. It does not make them
movable: no member has signed in, no member turn has run, spawnClaudeCodeProcess
has still never been called, and lifting them was never mine to decide.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/chat/chat.ts

@@ -129,11 +129,12 @@ chatRouter.get('/sessions/:id', async (ctx) => {
 // Titles are resolved here rather than in the client, which can only name the sessions in the group it
 // happens to be browsing — which is how the list ended up showing raw ids for anything running elsewhere.
 chatRouter.get('/live', async (ctx) => {
-  const email = ctx.get('user').email;
+  const user = ctx.get('user');
+  const email = user.email;
   // Both harnesses, asked in parallel. Either failing contributes nothing rather than failing the panel:
   // both registry calls swallow their errors and return [].
   const [live, liveOpenCode] = await Promise.all([
-    sidecar.listLiveClaudeSessions(),
+    sidecar.listLiveClaudeSessions(user.id),
     sidecar.listLiveOpenCodeSessions(),
   ]);
   const sessions = live.map((session) => {