feat(h5): web 联网能力、实时查询路由与 session Finish 对齐

- 新增 web 能力并挂载 platform/web（web_search/fetch_url）
- 实时查询强制 web skill，router fallback 与 await session Finish
- Session Broker 覆盖率/指标、stream replay 与相关单测/E2E 脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

session-broker-metrics.test.mjs

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  createSessionBrokerMetrics,
+  formatSessionBrokerMetric,
+  isSessionBrokerMetricsEnabled,
+} from './session-broker-metrics.mjs';
+
+test('isSessionBrokerMetricsEnabled respects env flag', () => {
+  assert.equal(isSessionBrokerMetricsEnabled({}), false);
+  assert.equal(isSessionBrokerMetricsEnabled({ MEMIND_SESSION_BROKER_METRICS: '1' }), true);
+});
+
+test('createSessionBrokerMetrics emits structured lines when enabled', () => {
+  const lines = [];
+  const metrics = createSessionBrokerMetrics({
+    enabled: true,
+    logger: { log: (line) => lines.push(line) },
+  });
+  metrics.ownershipDenied({ userId: 'u1', sessionId: 's1' });
+  metrics.registerDuplicate({ userId: 'u1', sessionId: 's1', target: 'https://127.0.0.1:18006' });
+  metrics.resolveTargetMiss({ sessionId: 's1', node: 2, reason: 'legacy_node_fallback' });
+  assert.equal(lines.length, 3);
+  assert.match(lines[0], /\[session_broker\.ownership\.denied\]/);
+  assert.match(lines[1], /register\.duplicate/);
+  assert.match(lines[2], /resolve_target\.miss/);
+  assert.match(formatSessionBrokerMetric('ownership.denied', { sessionId: 's1' }), /"sessionId":"s1"/);
+});
+
+test('createSessionBrokerMetrics stays silent when disabled', () => {
+  const lines = [];
+  const metrics = createSessionBrokerMetrics({
+    enabled: false,
+    logger: { log: (line) => lines.push(line) },
+  });
+  metrics.ownershipDenied({ userId: 'u1', sessionId: 's1' });
+  assert.equal(lines.length, 0);
+});