fix(bot): restore API session discovery after restart

[ehz0ah]

Description

VikingBot persists chat sessions through SessionManager, but the public session list, detail, and delete endpoints only consulted the process-local _sessions catalog. After a restart, the durable JSONL session remained available internally while the API returned an empty list and 404 for detail and delete.

This change makes the existing durable session store the discovery source for the public API. Discovery remains limited to the authenticated principal and OpenAPI channel. It also persists sessions created through POST /bot/v1/sessions, returns their durable messages, and preserves delete-generation isolation.

Issue #6125 includes the source-pinned reproduction. At revision 621b1ddd9945c362464d18482adb1a48df5ee554, one session with two persisted messages survived restart, while list returned zero sessions and detail/delete returned 404. The deterministic probe produced the same result in two runs.

Human Involvement

• A human participated in the implementation or review loop
• This PR was generated entirely by AI agents without human participation in the loop

Related Issue

Fixes #6125

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test update

Changes Made

• Discover persisted OpenAPI sessions by principal scope and channel identity.
• Persist explicitly created empty sessions and load durable messages for detail responses.
• Keep delete-generation behavior intact and ignore stale files from prior generations.
• Extend restart coverage for list, detail, delete, reused IDs, and interrupted cleanup.

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this on the following platforms:
  • Linux
  • macOS
  • Windows

Validation completed:

• python -m pytest bot/tests/test_openapi_auth.py -q — 47 passed
• python -m pytest bot/tests/test_session_portable_paths.py bot/tests/test_openviking_session_retention.py -q — 16 passed
• ruff check bot/vikingbot/channels/openapi.py bot/tests/test_openapi_auth.py
• ruff format --check bot/vikingbot/channels/openapi.py bot/tests/test_openapi_auth.py
• git diff --check

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Screenshots (if applicable)

Not applicable.

Additional Notes

The implementation reuses the current SessionManager storage and generation markers. It does not introduce a second catalog or storage format.