feat(sim): discovery file and simulation start options for local companions

[and2049]

Two small additions so local companion tools (an MCP server, a test harness, an accessibility companion) can work alongside the desktop app without changing how it binds or what it exposes.

Backend discovery file

The embedded backend binds 127.0.0.1:0, so nothing outside the process could find it. The desktop now writes <data_dir>/server.json (url, pid, started_at) via stage-and-rename right after the backend binds, and removes it on graceful shutdown. Removal is guarded by pid, so an older instance shutting down never deletes a newer instance's record. The file holds no credentials; readers must confirm with GET /healthz since a crash leaves it behind. The bind stays loopback-only. Documented in the README under "Data and settings".

Simulation start options and speed route

• POST /api/sessions/{key}/live-simulation/start accepts an optional JSON body { "start_t" | "start_lap", "speed" }. Without a body, behaviour is unchanged. start_lap resolves to the first persisted frame of that leader lap by bisecting the frame index; start_t is clamped to the replay bounds. Both selectors at once, a lap beyond the replay, or a non-positive speed return 400.
• New POST /api/sessions/{key}/live-simulation/speed with { "speed" } changes a running simulation's speed using the existing clock rebase, so current_t stays continuous. 404 when nothing is running. The ?speed= query on /stream behaves as before.
• Contract documented in shared/contracts/replay-api.md.

Tests

• desktop-gpui: discovery round-trip and removal; foreign-pid record left alone.
• backend: start_t clamping, start_lap resolution and out-of-range rejection, conflicting selectors and invalid speed, speed continuity, plus an API test for all three routes. Full backend suite passes (219).