feat(console): unify management APIs and terminal session controls

[Coooolfan]

Summary

• Reorganize management HTTP endpoints from /api/v1/console/* into resource-oriented paths: /auth/login, /auth/logout, /auth/session, /auth/password, /api-keys, /tokens, /accounts; admin account creation moves to POST /accounts. Legacy /api/v1/console/* routes stay registered as compatibility aliases.
• Add owner-scoped terminal session management: GET /sessions (paginated), GET /sessions/:session_id, DELETE /sessions/:session_id, reporting worker binding, status (ready / unavailable / reconciling), lease expiry, last-used and created timestamps.
• Persist created_at on terminal session routes so it survives rebinding and restart recovery; validate external session_id charset before scoping at task dispatch.
• Update web dashboard clients to the new paths; refresh docs/API*.md, website docs (EN/zh-CN), and project READMEs.

Test plan

• go test ./internal/httpapi ./internal/grpcserver — new coverage for session list/get/delete, scoped session ID parsing, and session_id validation
• yarn vitest run in web/ — 69 tests pass with updated API paths

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.