fix(gateway): isolate dot-segment session storage paths

[NianJiuZst]

Purging a session named . or .. could recursively delete every session or the entire storage root, including when that session did not exist. Encode these IDs as ordinary directory names and reject empty storage keys before resolving any session path. Existing encodings for normal IDs remain compatible.

关联 Issue

Closes #117

变更类型

• fix bug 修复

影响范围

• 改动了 src/gateway/（session authority 行为变更）

变更说明

The fix lives in the shared storage layout helpers, protecting purge as well as snapshot, event, asset and trace paths. Dot-only IDs still round-trip and remain distinct from literal percent-encoded IDs.

Regression tests exercise the real authenticated HTTP DELETE endpoint with temporary storage. They verify that unknown dot-only IDs preserve unrelated data and that purging an existing encoded session deletes only its own directory. No model calls or user storage are involved.

测试计划

• Before the fix: 12 regression assertions failed, including both HTTP data-loss cases.
• pnpm exec vitest run src/gateway/storage/layout.test.ts tests/integration/session-purge.test.ts — 43 passed.
• pnpm check — passed; 1,542 tests passed, 7 skipped.
• pnpm test:coverage — passed; statements 83.73%, branches 85.04%.

自检清单

• Local checks and Git hooks passed without bypassing hooks.
• New regression tests accompany the storage change.
• No binaries, generated artifacts or credentials included.

Validation was performed on macOS arm64 with Node.js 26.8.1. The repository's Windows/Linux CI remains the cross-platform validation gate.