Expose cross-project session listing and session deletion over RPC

[m-aebrer]

Summary

The planned web dashboard (#307) has a fleet-centric home screen: sessions across all projects, with resume and delete actions. RPC mode cannot serve this today — session listing is per-project only, and session deletion does not exist outside a TUI component. This issue extends the RPC surface so the dashboard can be a pure RPC consumer instead of importing SessionManager directly (the hybrid boundary the closed draft PR used).

Current Behavior

• list_sessions (rpc-mode.ts, case "list_sessions") calls SessionManager.list(cwd, sessionDir) — current project only.
• SessionManager.listAll() (session-manager.ts) already lists sessions across all project directories but is not exposed over RPC.
• Session deletion exists only as a private deleteSessionFile() helper inside the TUI session selector (modes/interactive/components/session-selector.ts): tries the trash CLI first, falls back to unlink, and the TUI guards against deleting the currently active session. None of this is available to core or RPC consumers.

Proposed Behavior

• New RPC command list_all_sessions returning the same per-session metadata as list_sessions (path, id, cwd, name, created, modified, messageCount, firstMessage) for all projects.
• New RPC command delete_session taking a session file path:
  • Refuses to delete the currently active session (explicit error).
  • Trash-first with unlink fallback, reporting which method was used.
  • Loud, descriptive errors on failure — no silent fallback.
• Move the trash/unlink deletion logic from the TUI component into core (e.g. SessionManager), and refactor the TUI session selector to use the shared implementation.

Acceptance Criteria

• list_all_sessions and delete_session commands and typed responses added to rpc-types.ts and handled in rpc-mode.ts.
• Deletion logic lives in core; the TUI session selector delegates to it (no behavior change in the TUI).
• delete_session errors clearly when targeting the active session, a nonexistent path, or a path outside the sessions directory.
• RpcClient gains corresponding methods.
• Tests cover both commands including error paths.
• docs/rpc.md documents both commands.

Context

• Parent: Build first-class dreb web dashboard #307 (dashboard implementation)
• Identified as a prerequisite in the assessment on Design dreb dashboard UX/UI for TUI feature parity #311 (dashboard UX design — fleet-centric IA decision)

Technical Notes

• SessionManager.listAll() accepts an onProgress callback; the RPC response can be a single reply (progress streaming not needed for the first version, but listing may be slow with many sessions — worth noting in docs).
• switch_session already takes a session path cross-project; delete_session should follow the same path-based addressing.

[m-aebrer]

Acceptance criterion (c) struck — sessions-directory containment removed by design

Following the third-pass review on #315, the maintainer decision is to remove the sessions-directory containment guard from delete_session rather than harden it further. Acceptance criterion (c) — "errors clearly when targeting … a path outside the sessions directory" — is withdrawn.

Rationale:

• The criterion contradicted this issue's own Technical Notes. The notes direct delete_session to "follow the same path-based addressing" as switch_session — and switch_session has no containment guard; it loads any path handed to it. Criterion (c) and the "mirror switch_session" guidance could not both hold.
• It defended a non-threat. RPC is a trusted, local, single-user channel. A deletion-only containment boundary that the sibling switch_session (which loads arbitrary session files) doesn't have buys nothing, while the lexical path-prefix matching it required generated a recurring class of bypass findings (symlink deref, empty-allowedDirs → cwd widening, TOCTOU) across three review cycles.
• The dashboard (Build first-class dreb web dashboard #307) owns authorization. Per the Build first-class dreb web dashboard #307 design, the frontend exposing this RPC surface enforces its own authz; duplicating a weaker version in core deletion is redundant.

What delete_session still guarantees (criteria a & b, unchanged):

• Refuses the currently active session (explicit error).
• Refuses non-.jsonl paths and nonexistent files (explicit errors).
• Trash-first with unlink fallback, loud structured errors, no silent fallback.

This matches switch_session's unrestricted, cross-project path addressing. Implemented in #315.