feat(web): expose Pi-native turn cancellation

[seekskyworld]

Problem

Implements the first runtime slice of #342. The Web host had no per-turn cancellation endpoint and could only abort sessions during host disposal.

Value

A browser client can request cancellation without tearing down unrelated Web runtime state, while stale Session requests are rejected.

Approach

Add an optional interruptTurn controller seam backed by Pi AgentSession.abort(). Bind the request to the active Session id, return cancelled or already_settled, emit a cancellation event, and expose POST /api/prompt/cancel. Existing test doubles remain compatible through the optional interface member.

Validation

• npx tsc --noEmit
• node --test --experimental-strip-types tests/web/pi-runtime.test.ts tests/web/web-host.test.ts (39 passed)
• git diff --check

Impact

• User-visible behavior: adds a server cancellation seam; UI control wiring remains a follow-up.
• Model-visible context/tools: none.
• Runtime/lifecycle: per-turn abort is distinct from host disposal and uses Pi lifecycle.
• Persisted config/data: none.
• Compatibility/risk: old controllers without the optional seam receive a bounded 501 response.