Let the module resolve a backend session, so proxied Composio can run in it - #102

Unblocks the last of openhuman#5560. Without this the host cannot delete its in-process engine without breaking Composio sync for its default configuration.

The problem

Composio sync has two credential paths and only one worked inside a loaded module:

if mode == "direct" {
    let api_key = composio_host::api_key(config)   // a SEAM — works in the module
} else {
    let bearer = config.session_token()?           // a CONFIG FIELD — does not
}

Inside a module, Config is EngineRuntimeConfig — a load-time snapshot with no bearer in it — so session_token refuses by design and every proxied user falls out of the branch.

The consequence was quiet and large: composio_sync_can_run gated the periodic loop on direct mode, so a host whose Composio mode is backend — OpenHuman's default — got a loop that never started. Neither side reported it, because neither believed it was responsible.

The fix

ComposioHost gains session_bearer, sitting beside the api_key that already works. composio_config's proxied branch consults the seam first and falls back to the config exactly as before, so a host running the engine in-process is unaffected — no seam installed there, the accessor answers None, the old config read still happens.

Why a seam and not a ModuleConfig field

The bearer is an app-session JWT the host refreshes. A value captured at module load works until it expires and then makes every sync fail with an auth error that reads as the user being signed out — the silent-staleness failure this migration keeps having to design against. Asking per call means the answer is always the one valid now. Same reasoning api_key already carries.

What the gate still excludes

Both modes qualify now: direct resolves a key, backend resolves a bearer. Still refused is a host that resolved to neither — an empty or unrecognised mode string has no credential path, so starting the loop would fail every tick and append a failed audit row each time.

Two deliberate asymmetries

The trait member is defaulted to None, so a host predating it compiles unchanged and falls back to the config read.

session_bearer does not copy is_available's optimism. That probe answers true when it cannot reach the host, because a wrong false reads as "not signed in" and hides a broken sync. A credential is not something to be optimistic about: an unreachable host yields None, which lets composio_config refuse by name rather than send an empty bearer at the backend. The test pins both halves.

Not a registered bus method

ComposioHost is served by the host and consumed by the module, like ChatHost, EmbeddingHost and RuntimeHost — so it appears in none of METHODS, the module manifest or EXPECTED_METHODS, and the drift assertion is untouched.

Validation

cargo check --workspace --all-targets clean in both workspaces; cargo test --workspace 2034 passing, module lane 70 passing; clippy -D warnings clean on root and module; cargo fmt clean on both; cargo doc --no-deps --all-features clean under -D warnings.

One existing test changed meaning rather than being deleted: composio_periodic_sync_starts_only_when_the_host_resolved_direct_mode asserted the constraint this PR removes. It is now ..._starts_for_any_mode_that_can_resolve_a_credential, with the reason for the change written into its doc.