feat(web): add bounded session search endpoint

[seekskyworld]

Problem

Implements the bounded metadata-search slice of #349. Web search was limited to browser-side filtering and had no reusable server boundary.

Value

Clients can search Session names, first-message previews, and workspace paths without loading every transcript into the browser.

Approach

Add an adapter search method with a 200-character query bound, optional archived filtering, and a 100-result cap. Expose it through authenticated GET /api/search; canonical Session files remain the source of truth and transcript-aware indexing remains future work.

Validation

• npx tsc --noEmit
• node --test --experimental-strip-types tests/web/web-host.test.ts tests/web/pi-adapter.test.ts (32 passed)
• git diff --check

Impact

• User-visible behavior: adds a bounded server search endpoint.
• Model-visible context/tools: none.
• Runtime/lifecycle: read-only projection.
• Persisted config/data: none.
• Compatibility/risk: no existing endpoint changes; full transcript search/indexing is not claimed.

[tt-a1i]

和 #376 选一个；这不是 #387

内存里搜 name/preview/cwd，200 字符 / 100 命中，不加载 transcript，归档默认不搜 — 切片干净。但没有分页、没有测试、truncated 写死。#376 改了同一套函数的参数形状。

请和 #376 合成一份带测试的元数据搜索。transcript 正文搜索留给 #387。