feat(sdk): server-side ChatStream / AgentChat -> Sessions (phase D)

Rewires the server-side AgentChat class in chat-client.ts onto the
Session primitive, matching the browser transport's shape.

- ChatSession persistence and SessionState internal state now key on
  sessionId (friendlyId). runId is optional, just a 'live run' hint.
- triggerNewRun upserts the backing Session via sessions.create
  (idempotent on externalId = chatId) before triggering so sessionId
  rides along in payload.
- sendRaw, steer, sendAction, close, stop all go through
  appendToSessionStream(sessionId, 'in',
  serializeInputChunk({kind: …})). Stop becomes {kind: 'stop'};
  messages become {kind: 'message', payload}; actions and close go
  through the message payload with trigger='action' / 'close'.
- Subscribe moves from /realtime/v1/streams/{runId}/chat to
  /realtime/v1/sessions/{sessionId}/out. Records arrive as JSON
  strings; the loop parses them back into objects before the
  trigger:turn-complete / trigger:upgrade-required dispatch.
- Upgrade-required path keeps the same Session, swaps runId only.
- Drops the CHAT_STREAM_KEY / CHAT_MESSAGES_STREAM_ID /
  CHAT_STOP_STREAM_ID imports from chat-constants.js — chat-client.ts
  no longer references the legacy stream keys (the constants file
  itself will be deleted in Phase F along with the three references
  still in ai.ts's re-exports and chat-constants.ts itself).

Server-side auth uses apiClientManager.accessToken (the env secret
key), which has full scopes — no token-scoping changes needed here.
The browser transport's token-scope updates (Phase E) already cover
the client side.

Author: ericallam