refactor(index): one index session for index/watch/serve/brain/MCP setup

[ajianaz]

What

Adds index::session (IndexSession, ConfigSource, configure) as the single owner of config -> embedding backend -> vector store -> skip patterns -> project root (via IndexBridge) -> incremental index -> stats. index, index --watch, watch, serve, brain and the MCP brain tool all go through it.

Why

Closes #567

How

• prepare_index_config removed; commands/watch.rs and the brain arm no longer re-inline the steps.
• serve now takes the global --config (it used to pass None).
• MCP brain search now resolves the embedding backend. It uses ConfigSource::ProjectOnly (project .cora.yaml only, no env/global/API keys, per security(config): don't send API key to base_url from project .cora.yaml #563). resolve_backend only consumes the local brain.embedding string, so this does not widen the trust surface.
• Review-time index scanners use index_skip_patterns(config) = ignore.files + index_skip_files, the same set as indexing.
• cora index arm is thin dispatch to commands/index_cmd.rs.
• index --watch now delegates to the watch implementation (500ms debounce instead of a fixed 2s poll; watch's message wording). Flags unchanged. --rebuild now also refreshes the session's project id.
• Removed now-unused IndexBridge::current_root.

Testing

• cargo test --features tree-sitter passes
• cargo fmt --all -- --check passes
• cargo clippy --all-targets --features tree-sitter -- -D warnings passes
• cargo build --release not run (disk)
• New tests in index/session.rs: merged skip patterns, backend resolution (project-only path used by MCP), explicit --config honored, incremental stats, rebuild/prune, scanners and indexing sharing one skip source.

🤖 Generated with Claude Code