feat(runtime): remote runtime with full TUI parity and production readiness

[dgageot]

Summary

This PR implements 20 incremental steps to bring the remote runtime to full TUI parity and production readiness, building on top of the wire protocol scaffolding introduced in #2723.

---

Batch 1 — Feature parity (19 commits)

Every ErrUnsupported in RemoteRuntime is now gone.

Commit	What
50de1ad	SSE event streaming — GET /v1/sessions/:id/events
0215b65	Remote session store — list, get, delete sessions over wire
b90e7c8	Agent tools list — GET /v1/sessions/:id/tools
d081fdb	Model switching, MCP prompts, skills, compact, toolsets, pause
f9c333a	Snapshot operations — undo, reset, list snapshots
e960c67	Session store writes — add/update messages and summaries
89eb319	Session metadata — token counts, starred
f90424	Health & readiness endpoints — /health, /ready
4234c21 + 48d32a2	SSE reconnection with exponential backoff

Batch 2 — Production readiness

Commit	What
080da02	Per-request timeouts (30s metadata / 5m streaming) + server respects ctx cancellation
59fd74b	Batch session delete & export — one round-trip instead of N
1b9f9541	Graceful degradation on store failure + /v1/sessions/:id/recovery
0608896	Bearer token auth — --auth-token flag, middleware, WithAuthToken client option
bf25b1f	Queue depth endpoint + 429 backpressure with Retry-After header

Security fixes (post-review)

Commit	What
f061ac8	Constant-time token comparison, missing auth headers on SSE, context shadowing fix, backoff underflow guard
8360baa	Remove redundant UpdateSession calls that could overwrite concurrent writes
0105b5a	Missing select statement in retry backoff loop
c74ce71	Linter cleanup