feat(api): add session route shell

[Vaibhaav-Tiwari]

Summary

• add the first session route-shell slice on top of the code-first OpenAPI branch
• mount 501-backed session routes for list, spawn, get, restore, and send
• add Go wire DTOs and specgen operations, then regenerate openapi.yaml
• keep unclear/deferred routes unregistered for now: kill, patch/rename, patches, remap, orchestrators, platform read-models
• add LF normalization for the generated OpenAPI YAML drift check

Testing

• cd backend && go generate ./...
• cd backend && go test ./internal/httpd/apispec/...
• cd backend && go test ./internal/httpd/controllers/...
• cd backend && go test ./...

Notes

This PR is stacked on #59 because OpenAPI is generated from Go contract code there. It intentionally does not hand-edit OpenAPI YAML beyond the generated artifact.

[greptile-apps]

Greptile Summary

This PR adds the first session route-shell slice on top of the OpenAPI code-generation branch, mounting 501-backed handlers for list, spawn, get, restore, and send, and regenerating openapi.yaml from the new Go wire DTOs and sessionOperations().

• Adds SessionsController with five stub handlers, wires *session.Manager into APIDeps and NewAPI, and plugs the controller into the /api/v1 router group.
• Adds Go wire DTOs (SessionIDParam, ListSessionsQuery, SpawnSessionRequest, ListSessionsResponse, SessionResponse, SendSessionRequest, SendSessionResponse) and a sessionOperations() function in specgen/build.go.
• Adds a .gitattributes rule enforcing LF line endings on the generated YAML to prevent drift false-positives on Windows.

Confidence Score: 5/5

All five session handlers are 501 stubs that never touch real data; no existing behavior is changed.

Every route returns NOT_IMPLEMENTED today, so there is no runtime path through the new session code that can fail, corrupt state, or expose data. The spec and DTO additions are straightforward and covered by the existing drift test. The only gap — missing enum constraints on domain string fields — is a spec quality concern for future client generators, not a correctness issue in the running service.

No files require special attention; the generated openapi.yaml is produced deterministically by the drift-checked build pipeline.

Important Files Changed

Filename	Overview
backend/internal/httpd/controllers/sessions.go	New file: registers five 501-stub handlers for the session surface; all handlers delegate to apispec.NotImplemented and never dereference Mgr.
backend/internal/httpd/controllers/dto.go	Adds session wire DTOs; ListSessionsQuery.Project correctly typed as domain.ProjectID; enum-valued domain fields (kind, status, harness) surfaced as unconstrained strings in spec.
backend/internal/httpd/apispec/specgen/build.go	Adds sessionOperations(), moves hardcoded tag into the operation struct, adds schemaNames entries for new session types.
backend/internal/httpd/api.go	Wires *session.Manager into APIDeps and SessionsController and plugs sessions into the router group.
backend/internal/httpd/controllers/sessions_test.go	Verifies all five routes return 501 NOT_IMPLEMENTED and three unregistered routes return 404 ROUTE_NOT_FOUND.
backend/internal/httpd/apispec/openapi.yaml	Generated artifact: adds session paths and component schemas; kind/status/harness/activity.state lack enum constraints.
.gitattributes	Enforces LF line endings on openapi.yaml to prevent spurious YAML drift on Windows checkouts.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Router as chi Router (/api/v1)
    participant SC as SessionsController
    participant Spec as apispec.NotImplemented

    Client->>Router: GET /api/v1/sessions
    Router->>SC: list(w, r)
    SC->>Spec: NotImplemented
    Spec-->>Client: 501 NOT_IMPLEMENTED

    Client->>Router: POST /api/v1/sessions
    Router->>SC: spawn(w, r)
    SC->>Spec: NotImplemented
    Spec-->>Client: 501 NOT_IMPLEMENTED

    Client->>Router: "GET /api/v1/sessions/{id}"
    Router->>SC: get(w, r)
    SC->>Spec: NotImplemented
    Spec-->>Client: 501 NOT_IMPLEMENTED

    Client->>Router: "POST /api/v1/sessions/{id}/restore"
    Router->>SC: restore(w, r)
    SC->>Spec: NotImplemented
    Spec-->>Client: 501 NOT_IMPLEMENTED

    Client->>Router: "POST /api/v1/sessions/{id}/send"
    Router->>SC: send(w, r)
    SC->>Spec: NotImplemented
    Spec-->>Client: 501 NOT_IMPLEMENTED

Loading

_{Reviews (3): Last reviewed commit: "fix(api): remove unused session schema n..." | Re-trigger Greptile}

[Vaibhaav-Tiwari]

Closing this as superseded by #68, which merged the newer service-layer session API work on main. Any remaining useful pieces from this branch, like generated OpenAPI LF normalization or dropped-route test coverage, should be carried forward as a fresh small PR from main if still needed.