core, webclient: cheap session lists, changed-row saves, smaller bundle ...

The sidebar asked for a count and a 60-char snippet and got every hot
message of every listed session: 2,097 rows / 4.4 MB for 507 sessions,
plus a full Pydantic hydration. list_page now aggregates counts and the
last displayed line in SQL (4.0 ms, 30 rows); get_meta folds its COUNT
into the same round trip.

save() runs after every streaming step and rewrote the whole hot
history each time — 1,016 UPDATEs, 46.8 ms, per call, growing with the
session. A fingerprint of the mutable columns lets it touch only the
rows that changed, which is normally the tail.

HTTP: content-hashed /assets are immutable for a year, gzip drops to
level 6 (same ratio within a couple of percent on JSON, half the CPU),
and session search gets pg_trgm GIN indexes when the extension exists.

Client: one shared highlight.js on lib/common plus the languages we
actually render (openscad included) instead of the full ~190-language
entry point, and the unused @tanstack/vue-virtual is gone.
Bundle 1566 -> 760 kB (gzip 495 -> 238 kB).

webclient: make session loads cheap, cancellable and honest ...

Opening a session moved ~1 MB of history JSON and a 1.5 MB bundle
uncompressed, then reloaded the whole transcript on every WebSocket
reconnect; a failed request wiped what was on screen.

Server: GZipMiddleware(1 KB) - one history page shrinks 5.1x, the SPA
bundle 3.2x.

Client:
- session_sync asks /meta instead of reloading history, and only when
  the view is idle;
- session loading keeps the previous transcript until the new data
  arrives, aborts the request it replaced, ignores stale responses and
  surfaces a retryable error banner;
- search-jump pagination no longer pages through the previous session's
  history;
- REST calls get a 30 s timeout and caller abort support;
- WS queue overflow rejects the message and marks the bubble "not sent"
  instead of silently dropping the oldest;
- tool card bodies mount on first open (a 38-card session drops ~1 MB of
  markup and ~25k elements);
- identical /sessions requests coalesce, the streaming watch is a cheap
  signature, the content-tool key is one store computed, useTime shares
  one 30 s ticker, connect() clears the retry timer.

e2e opens result cards explicitly now that bodies are lazy.