Add Session.codeProvider for cross-backend pairing

[dgershman]

Follow-up to #410 / ADR 0005.

Today Session.provider (Packages/CrowCore/Sources/CrowCore/Models/Session.swift)
means both task source and code source. ADR 0005 documents this as a v1 limitation —
the protocol split exists precisely so a Corveil-tasked session can use a GitHub or
GitLab CodeBackend, but the model can't represent that yet.

This ticket adds Session.codeProvider: Provider? so the two halves can come from
different providers.

Acceptance

• Session.codeProvider: Provider? exists.
• Default migration: existing sessions get codeProvider = provider.
• SessionService / IssueTracker look up codeBackend(for: session.codeProvider ?? session.provider).
• Persistence round-trip covered by tests.

References:

• ADR 0005: docs/adr/0005-task-and-code-backend-protocols.md ("Session model" / v1 limitation)
• PR Extract TaskBackend + CodeBackend protocols (#410) #411