feat(web): cloud session viewer alignment for browser

[beruro]

Problem

The ORGII desktop app already supports cloud org sessions in the workstation sidebar and read-only remote viewing, but there was no dedicated browser entry to sign in, list My/Team cloud sessions, and open a session with the same transcript and simulator chrome users expect on desktop. The original PR also referenced several local-only modules that were never committed, so its clean GitHub runner failed TypeScript compilation before lint or tests could run.

Solution

Add a webpack-backed web shell with Org2Cloud auth, cloud session roster and event runtime over the unified HTTP session API, sidebar alignment with desktop cloud scopes, session page composition via shared RemoteSession surfaces, and replay decoupling so read-only cloud viewing stays responsive.

The CI repair commits every production dependency and owning-boundary test required by the Web viewer, restores unrelated plan/slash-command behavior instead of depending on local refactor files, merges the latest develop, and fixes the resulting type/nullability/test-fixture errors. It also:

• completes the browser tool-registry fallback and controlled desktop/Web presentation boundaries;
• pauses replay timers while the document is hidden and disposes them on unmount;
• keeps cloud polling visibility-aware, single-flight, abortable, and generation-guarded;
• bounds the identity-scoped IndexedDB event cache to 12 sessions, 10,000 events per session, and a 24-hour TTL, with oldest-entry eviction and database connection cleanup;
• records the 59 missing i18n calls inherited from the merged develop tip by exact source file, while continuing to fail any new missing source key elsewhere; and
• adds the missing English source key introduced by this PR.

Potential risks

• Authenticated cloud-session browser rendering and large-history CPU/RSS behavior were not manually measured because no disposable signed-in Org2Cloud browser fixture was available. The PR remains Draft for that product-level verification even though build and automated checks pass.
• The active session still materializes its authorized event history for transcript/replay rendering. Persistent storage is bounded, but an unusually large currently open history can still consume proportional memory.
• Sessions above 10,000 events are intentionally not persisted in the browser cache; reopening one requires a network read.
• The 59 path-scoped i18n baseline calls remain technical debt from develop. New missing keys in other files fail CI, and each baseline entry can be removed when its English resource is repaired.
• No Rust files are changed by this PR. Local Rust clippy was not rerun; the GitHub Rust (clippy) job passed as the verification boundary.

Audit

• Architecture: covered compilation/types, dependency reachability, replay FSM/defaults, shared host boundaries, naming, and desktop/browser registry initialization parity. Wire-schema and multi-field resolver symmetry layers were not changed by the CI repair.
• Frontend UI audit: 0 fixes recommended, 12 existing/custom-geometry decisions kept with documented reasons, 0 new abstraction candidates. Reports are under docs/frontend-ui-audit-2026-08-21/.
• Performance: background work has one visibility-aware 30-second running-session poll and one non-overlapping replay timeout; both stop while hidden. Requests are single-flight/abortable/generation-guarded, cache keys include endpoint + user + org + session, and persistent retention is bounded as described above. Automated lifecycle/bound tests pass; authenticated rendered measurement remains unverified as called out in risks.

Verification

Run from a clean detached worktree at f5bb48ba5 with no local untracked files:

• pnpm typecheck — passed.
• pnpm lint — passed with 0 errors and 5 existing develop warnings.
• pnpm check:i18n:contracts — passed; 7,418 static calls checked, 59 path-scoped baseline calls allowed, and 149,741 existing translated values validated across 13 locales.
• pnpm run test — full Vitest suite passed.
• pnpm build:web — production webpack build passed.
• git diff --check — passed.
• Targeted Web/replay/remote-surface suites — 19 files and 59 tests passed.
• Cache and hidden-document timer regression suites — 2 files and 5 tests passed.
• Pre-commit lint-staged ESLint/Prettier and scoped TypeScript checks — passed for the 38-file CI repair commit.
• GitHub required checks — Frontend, Rust clippy, and AI attribution all passed.

Not run: authenticated browser visual walkthrough/screenshots and large-history CPU/RSS measurement (no disposable signed-in cloud fixture); local Rust clippy (no Rust diff, GitHub clippy passed).