fix: add session origin tracking + idle rotation foundation (schema/auth/config)

Backend infrastructure for WeChat/H5 session unification:

- schema.sql: h5_user_sessions adds origin ENUM('h5','wechat') column
- db.mjs: idempotent migration for origin column (adds after user_id)
- user-auth.mjs:
  - setSessionOrigin(sessionId, origin) - tag where session was created
  - getSessionOrigins(sessionIds) - batch lookup for history labeling
  - touchWechatAgentRoute(appId, openid) - refresh activity timestamp
- wechat-mp.mjs:
  - DEFAULT_SESSION_IDLE_ROTATE_MS = 30min (env-configurable)
  - loadWechatMpConfig includes sessionIdleRotateMs

Tests: 50/50 pass ✓

Still TODO:
- ensureWechatAgentSession idle rotation check + setSessionOrigin call
- runIntentMessage grantedSkills flow + touchWechatAgentRoute calls
- Frontend type/UI component updates
- Integration test for idle rotation

Co-Authored-By: Claude <noreply@anthropic.com>

schema.sql

@@ -350,6 +350,7 @@ CREATE TABLE IF NOT EXISTS h5_user_path_grants (
 CREATE TABLE IF NOT EXISTS h5_user_sessions (
   agent_session_id VARCHAR(128) NOT NULL PRIMARY KEY,
   user_id CHAR(36) NOT NULL,
+  origin ENUM('h5', 'wechat') NOT NULL DEFAULT 'h5',
   created_at BIGINT NOT NULL,
   KEY idx_h5_user_sessions_user (user_id),
   CONSTRAINT fk_h5_session_user FOREIGN KEY (user_id) REFERENCES h5_users(id) ON DELETE CASCADE