feat(h5): web 联网能力、实时查询路由与 session Finish 对齐

- 新增 web 能力并挂载 platform/web（web_search/fetch_url）
- 实时查询强制 web skill，router fallback 与 await session Finish
- Session Broker 覆盖率/指标、stream replay 与相关单测/E2E 脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

user-auth.mjs

@@ -1680,6 +1680,17 @@ export function createUserAuth(pool, options = {}) {
     );
   };
 
+  /** Enable platform/web (web_search, fetch_url) for existing role defaults. */
+  const upgradeWebCapability = async () => {
+    const now = Date.now();
+    await pool.query(
+      `INSERT INTO h5_capability_grants (subject_type, subject_id, capability_key, allowed, updated_at)
+       VALUES ('role', 'user', 'web', 1, ?)
+       ON DUPLICATE KEY UPDATE allowed = 1, updated_at = VALUES(updated_at)`,
+      [now],
+    );
+  };
+
   /** Enable platform skill loading + chat recall for existing role defaults. */
   const upgradeDefaultUserCapabilities = async () => {
     const now = Date.now();
@@ -2117,6 +2128,7 @@ export function createUserAuth(pool, options = {}) {
     }
     await seedRoleCapabilityDefaults();
     await upgradeMemoryStoreCapability();
+    await upgradeWebCapability();
     await upgradeDefaultUserCapabilities();
     await seedRolePolicyDefaults();
     await seedRoleSkillDefaults();