fix: add session origin tracking + idle rotation foundation (schema/auth/config)

Backend infrastructure for WeChat/H5 session unification:

- schema.sql: h5_user_sessions adds origin ENUM('h5','wechat') column
- db.mjs: idempotent migration for origin column (adds after user_id)
- user-auth.mjs:
  - setSessionOrigin(sessionId, origin) - tag where session was created
  - getSessionOrigins(sessionIds) - batch lookup for history labeling
  - touchWechatAgentRoute(appId, openid) - refresh activity timestamp
- wechat-mp.mjs:
  - DEFAULT_SESSION_IDLE_ROTATE_MS = 30min (env-configurable)
  - loadWechatMpConfig includes sessionIdleRotateMs

Tests: 50/50 pass ✓

Still TODO:
- ensureWechatAgentSession idle rotation check + setSessionOrigin call
- runIntentMessage grantedSkills flow + touchWechatAgentRoute calls
- Frontend type/UI component updates
- Integration test for idle rotation

Co-Authored-By: Claude <noreply@anthropic.com>

wechat-mp.mjs

@@ -25,6 +25,7 @@ const DEFAULT_STATUS_TEXT =
 const DEFAULT_UNSUPPORTED_TEXT = '当前先支持文字消息，你可以直接发文字给我。';
 const DEFAULT_UNBOUND_TEXT = '先点这里完成绑定，再继续和专属 Agent 对话：';
 const DEFAULT_PROGRESS_DELAY_MS = 8000;
+const DEFAULT_SESSION_IDLE_ROTATE_MS = 30 * 60 * 1000;
 const PUBLIC_HTML_LINK_PATTERN =
   /https?:\/\/[^\s<>"')\]]+\/MindSpace\/([0-9a-f-]{36}|[a-z0-9._-]+)\/public\/([^\s<>"')\]]+\.html)/gi;
 const SESSION_WORKSPACE_TOOL_NAMES = new Set([
@@ -1254,6 +1255,10 @@ export function loadWechatMpConfig(env = process.env) {
       0,
       Number(env.H5_WECHAT_MP_PROGRESS_DELAY_MS ?? DEFAULT_PROGRESS_DELAY_MS),
     ),
+    sessionIdleRotateMs: Math.max(
+      0,
+      Number(env.H5_WECHAT_MP_SESSION_IDLE_ROTATE_MS ?? DEFAULT_SESSION_IDLE_ROTATE_MS),
+    ),
     statusText: env.H5_WECHAT_MP_STATUS_TEXT?.trim() || DEFAULT_STATUS_TEXT,
     unsupportedText: env.H5_WECHAT_MP_UNSUPPORTED_TEXT?.trim() || DEFAULT_UNSUPPORTED_TEXT,
     unboundTextPrefix: env.H5_WECHAT_MP_UNBOUND_TEXT_PREFIX?.trim() || DEFAULT_UNBOUND_TEXT,