fix(session): expose idle lifetime and preserve timeout reason

[XY-code1]

Summary

Fixes #386.

Make session idle expiration observable without changing the existing idle
semantics, default five-minute timeout, or daemon-global --session-idle
configuration.

Changes

• Add optional last_activity_at_ms and idle_timeout_ms fields to session
  list entries.
• Show the estimated remaining idle lifetime in human-readable
  bsk session list output.
• Preserve a structured session_idle_timeout reason after the idle reaper
  successfully stops a session.
• Bound the process-local stop-reason cache to 1,024 entries with a 10-minute
  TTL, cleaning expired entries on reads and writes.
• Keep lifecycle metadata out of system.status.
• Document the timeout behavior and lifecycle output.

The cache stores only session IDs and monotonic timestamps. It is not persisted
and contains no URL, title, form, or page data.

Compatibility

• The default timeout remains five minutes.
• --session-idle remains daemon-global.
• Only BrowserSkill tool activity refreshes the deadline.
• Page interaction is not treated as session activity.
• No keepalive command is introduced.
• New protocol fields are optional, so newer clients accept older daemon
  responses and older clients can ignore the additional fields.

Validation

Passed locally:

• cargo fmt --check
• cargo test -p bsk --test cli_parse --locked — 43 passed
• cargo test -p bsk-protocol --locked — 171 passed
• cargo test -p bsk daemon::sessions --locked — 8 passed
• git diff --check

Two new sessions_ipc tests could not complete locally because the current
Windows host cannot connect to the test named-pipe endpoint. Hosted CI must
verify:

• idle expiration removal and the retained timeout reason;
• session-list lifecycle projection and absence of page-sensitive data.