feat: persist conversations, isolate sessions, and fix request-pipeline reliability

[RvVeen]

Summary

This PR bundles the request/response pipeline work that all touches the same core
files (request.ts, request-handler.ts, sdk-client.ts). It persists Kiro
conversations across turns, isolates parallel sessions, routes Pro accounts to
the runtime endpoint, and fixes several reliability issues around streaming,
retries, and history trimming.

Problem

• Context loss: every request minted a fresh conversationId via
  crypto.randomUUID(), so each agentic turn started a brand-new Kiro session
  and the model lost prior context.
• History trimmed far too aggressively: the payload was trimmed at 600KB,
  over 6x below Kiro's real limit, discarding older turns prematurely.
• Parallel sessions collided: multiple OpenCode sessions in one workspace
  shared conversation state.
• Pro-only models unavailable: glm-5, minimax, etc. are only served by
  runtime.kiro.dev, but all requests went to q.amazonaws.com.
• Streaming/tool-call edge cases: tool calls could be double-emitted, long
  tool names exceeded Kiro's limit, and thinking output was not surfaced.
• Retry backoff counted against the request timeout budget, causing
  premature failures on rate-limited accounts.

Solution

• Conversation persistence: mint a stable conversationId +
  agentContinuationId per (workspace, fingerprint) and persist them in
  SQLite so agentic turns continue the same Kiro conversation. Reset a stale
  conversationId on a 400 ValidationException.
• Session isolation: key conversation state on the OpenCode x-session-id
  header so parallel sessions in one workspace stay distinct.
• Configurable history trim: raise the trim threshold to a configurable
  max_payload_bytes (default 4MB). Kiro's hard limit is structure-dependent
  (verified against the live API): a single message survives up to ~7.6MB, but
  many-entry histories are rejected as low as ~5.9MB, so the default stays
  safely below the lowest observed failure. Adds [PAYLOAD]/[TRIM] debug
  logging.
• Pro endpoint routing: accounts with a profileArn use runtime.kiro.dev
  (which serves the additional models); free Builder ID accounts keep using
  q.amazonaws.com, since the runtime endpoint 400s without a profileArn.
• Streaming/tool-call hardening: robust inline + bracket tool-call parsing
  without double-emission, per-tool stop tracking, tool-name shortening within
  Kiro's limit, and thinking passthrough.
• Retry budget fix: exclude backoff sleep from the request timeout budget.
• Add a cross-process reauth lock (pid + TTL) so concurrent instances don't
  re-authenticate simultaneously, with a bounded OAuth timeout.

Configuration

// kiro.json
{
  "max_payload_bytes": 4000000
}

Testing

• bun test — all tests pass (adds coverage for the request pipeline,
  streaming/tool-call parsing, image cache, and the conversation/reauth-lock
  parts of the SQLite store)
• bun run typecheck — clean
• bun run build — clean
• Live end-to-end verification against runtime.eu-central-1.kiro.dev,
  including multi-turn context retention and payload-trim behavior on oversized
  histories.