feat(nav): add in-app navigate back/forward

[tnbao]

Summary

• Add in-app Navigate back / Navigate forward over visited chat views (sessions and the new-chat composer), like other harness apps (opencode, codex): switching sessions via the sidebar, command palette, forks, or new chat pushes onto the stack; going back truncates the forward branch, browser-style. ?session= URL handling is unchanged.
• omp-web keeps its own in-memory stack instead of the browser History API — the app only ever replaces ?session= URLs, and the real history stack already belongs to the mobile back-gesture / exit-guard machinery (useSidebarHistory + the popstate bridge).
• Platform shortcuts: ⌘[ / ⌘] on macOS (Safari/Finder standard) and Alt+← / Alt+→ on Windows/Linux (the platform back/forward pair), plus the mouse back/forward buttons (BrowserBack / BrowserForward). Alt+Arrow is deliberately not bound on macOS, where it is word-wise caret movement. Shift chords are excluded (⌘⇧] switches tabs).
• The navigate keystroke is always swallowed while a handler is registered: an exhausted history stack stops dead instead of falling through to the browser's own back/forward, so the app can never be backed out of by accident. (The browser toolbar's back button is beyond a page's control and behaves as before.) Shortcuts are skipped while a modal dialog is open.
• The sidebar header gains browser-style back/forward arrow buttons (first in the quiet-utilities group, before Archived Sessions), disabled on stack bounds, with the platform shortcut in the tooltip. Below a 240px sidebar a container query hides them so the title never collides with the header icons; the shortcuts keep working at any width.
• Applying a step resolves the target session via /api/sessions: dead ids (deleted sessions) are dropped and the next entry in the same direction is tried, a failed list fetch aborts without dropping, and a view change during the await aborts the navigation so a slow fetch never yanks the chat away.
• New files: lib/navigation-history.ts (pure stack + shortcut matcher), hooks/useNavigationHistory.ts (record/peek/commit/drop controller). Recording the entry the cursor already sits on is a no-op, which makes back/forward application self-suppressing — it can never push onto itself.

Verification

• npm run typecheck — clean.
• npm run lint — 0 errors (11 pre-existing warnings, unchanged from main).
• npm test — 1165 tests: all pass except runCli with --status returns status object in bin/omp-web-tray.test.mjs, which also fails on unmodified main under the parallel full-suite run (it reads the machine's real ~/.omp/agent/web-service.json); it passes when run standalone. 28 new tests cover the stack arithmetic, the shortcut matcher matrix (both platforms, IME composition, shift/mixed-modifier rejections), the hook choreography (self-suppression, forward truncation, dead-entry drop), and a static-render check that the sidebar buttons sit before Archived Sessions inside their collapsible wrapper with correct disabled states.
• npm run build — compiles successfully.
• Manual browser pass still worth doing before merge: live ⌘[/⌘] and Alt+←/Alt+→ presses across sidebar/palette switches, fork then back, back onto a deleted session, repeated back at the end of the stack (must stay in the app), and dragging the sidebar below ~240px (buttons hide, title intact).