feat(h5-session): Session Broker、run SSE replay 与 Finish 竞态修复

落地 H5 Session 架构 Patch 1–5（Broker 收口、Router decision、SSE taxonomy、goosed 边界检查），
并新增可选 MEMIND_RUN_STREAM_REPLAY run 事件回放与 H5 假交付 guard；修复 Finish 先于 agent-run
gate 导致 UI 永久 loading 的竞态，接入 verify:h5-session-patches 回归脚本。

Co-authored-by: Cursor <cursoragent@cursor.com>

direct-chat-service.mjs

@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import { MEMORY_INTERVENTION_LIMIT } from './memory-intervention.mjs';
+import { resolveSessionAccess } from './session-broker.mjs';
 
 export const DIRECT_CHAT_SESSION_PREFIX = 'h5direct_';
 
@@ -257,12 +258,14 @@ function normalizeUsageForBilling(usage, previousState) {
 
 export function createDirectChatService({
   userAuth,
+  sessionAccess = null,
   llmProviderService,
   sessionSnapshotService,
   memoryV2 = null,
   conversationMemoryService = null,
   enabled = envFlag(process.env.MEMIND_DIRECT_CHAT_ENABLED, true),
 } = {}) {
+  const sessionStore = resolveSessionAccess({ userAuth, sessionAccess });
   function getStatus() {
     return {
       enabled,
@@ -323,7 +326,7 @@ export function createDirectChatService({
     const previousMessages = Array.isArray(snapshot?.messages) ? snapshot.messages : [];
     const now = new Date().toISOString();
     if (!sessionId) {
-      await userAuth.registerAgentSession(userId, activeSessionId, 'h5-direct');
+      await sessionStore.registerAgentSession(userId, activeSessionId, 'h5-direct');
     }
     if (typeof onSessionReady === 'function') {
       await onSessionReady(activeSessionId);