feat(queue): add live steer and follow-up session input queues

[Fodesu]

Summary

• Add independent Steer and Follow-up queues for a session's active run, kept in the configured session runtime backend (memory or redis). They are live coordination state, deliberately not part of the PostgreSQL durable model.
• Steer items are bound to the run active at admission and consumed at the step commit barrier, fenced to the run's owner, generation, and fencing token. A final step that finds no steer seals the run; a terminal run rejects its remaining steers.
• Follow-up items are bound to the session. At a run's terminal boundary the oldest follow-up is claimed and started through ordinary turn admission, which stays the single owner/fencing authority.
• A complete turn that meets a busy session on a local channel (web, cli) is parked in the follow-up queue with its full StartTurnCommand; platform channels keep the bounded busy retry because their reply is delivered from the caller's run handle.
• Remove the legacy /now, /btw, /next channel paths; add /steer and /queue slash commands, REST queue endpoints, split-runtime RPC, and a composer queue panel with edit, reorder, delete, and follow-up-to-steer promotion. /steer works on every channel because it joins the run the channel is already streaming; /queue is accepted only on local channels (web, cli) and platform channels get queue_follow_up_unsupported_channel, since they could not receive the reply of a run the server starts from the queue.

Architecture

• PostgreSQL remains authoritative for run admission, ownership and fencing, history, and decision state. It stores no queue payloads, claims, or step-commit records; the schema and migration chain are unchanged.
• Steer and Follow-up are separate Go types, runtime methods, and Redis keys. One queue's API cannot read or mutate the other's items.
• Each queue holds one document per session, bounded to 64 pending items (queue_capacity_exceeded) and the newest 64 terminal items. Invocation IDs give best-effort replay protection within that retention.
• Redis queue transactions watch only the queue document and the run key; the session state key is read but not watched, because it is rewritten on every streamed delta.
• A steer claimed at a deferred-decision step is not taken; the continuation's first committed step claims instead, and an existing unapplied claim is advanced to the run's current owner on reclaim.
• History keeps its turn model: every user message opens a turn, so an applied steer is persisted as its own turn and the output after it is filed under that turn while the run ID is unchanged. The web projection names the post-steer assistant segment after that turn once it is known.

Design notes: docs/design/session-input-queues.md.

Deliberate deviations from the original spec

• Queues are transient. A process restart with the memory backend, or a Redis data loss, discards pending items; normal run and history durability is unaffected.
• Follow-ups are not rejected when the run they were queued behind aborts, fails, or is lost; the queued input still belongs to the session. Only run-bound steers are rejected at terminal.
• The follow-up handoff is not atomic: an ordinary message may take the session slot between the terminal boundary and the follow-up's admission. The item stays accepted and is claimed again at the next terminal boundary.

Also in this PR

• Decision continuations (ask_user, tool approval) now log the private cause of a native stream error before it is reduced to a public error code.
• Web transcript merge inserts runtime frames in projection order instead of re-sorting by timestamp, and orders user before assistant within one turn when timestamps tie.

Validation

• go build ./..., go vet ./..., golangci-lint run ./..., and go test ./... pass.
• The Redis live-queue contract test (MEMOH_TEST_REDIS_URL) passes against a local Redis across two backend instances.
• pnpm lint and the UI contract guard pass; apps/web/src/store Vitest suites pass.
• pnpm vitest run reports 5 failures in desktop/media-gallery/dockview tests and pnpm -C apps/web typecheck fails in bot-select and config-schema-form; those files are identical to main and fail there in the same environment.

Known issue outside this PR

Answering an ask_user question on deepseek-v4-flash can fail with The reasoning_content in the thinking mode must be passed back to the API. The continuation replays stored history and DeepSeek rejects assistant tool-call messages without reasoning_content. This is independent of the queue changes and is being fixed in Twilight's completions provider.