fix: add session origin tracking + idle rotation foundation (schema/auth/config)

Backend infrastructure for WeChat/H5 session unification:

- schema.sql: h5_user_sessions adds origin ENUM('h5','wechat') column
- db.mjs: idempotent migration for origin column (adds after user_id)
- user-auth.mjs:
  - setSessionOrigin(sessionId, origin) - tag where session was created
  - getSessionOrigins(sessionIds) - batch lookup for history labeling
  - touchWechatAgentRoute(appId, openid) - refresh activity timestamp
- wechat-mp.mjs:
  - DEFAULT_SESSION_IDLE_ROTATE_MS = 30min (env-configurable)
  - loadWechatMpConfig includes sessionIdleRotateMs

Tests: 50/50 pass ✓

Still TODO:
- ensureWechatAgentSession idle rotation check + setSessionOrigin call
- runIntentMessage grantedSkills flow + touchWechatAgentRoute calls
- Frontend type/UI component updates
- Integration test for idle rotation

Co-Authored-By: Claude <noreply@anthropic.com>

db.mjs

@@ -387,6 +387,12 @@ export async function migrateSchema(pool) {
     );
   }
 
+  if (!(await columnExists(pool, 'h5_user_sessions', 'origin'))) {
+    await pool.query(
+      `ALTER TABLE h5_user_sessions ADD COLUMN origin ENUM('h5', 'wechat') NOT NULL DEFAULT 'h5' AFTER user_id`,
+    );
+  }
+
   if (!(await columnExists(pool, 'h5_session_snapshots', 'display_title'))) {
     await pool.query(
       `ALTER TABLE h5_session_snapshots ADD COLUMN display_title VARCHAR(512) NOT NULL DEFAULT '' AFTER name`,