batch3 T2: panes CRUD route + default chat pane on session POST

Adds /api/sessions/:id/panes (GET, POST), /api/panes/:id (PATCH, DELETE)
with transactional position-shift logic (negate-and-restore pattern to
avoid UNIQUE collisions). Max 5 panes per session enforced.

Sessions.POST now creates the session and a default Chat pane at position
0 atomically via sql.begin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/server/src/routes/sessions.ts

@@ -74,11 +74,18 @@ export function registerSessionRoutes(
       const name = parsed.data.name ?? 'New session';
       const systemPrompt = parsed.data.system_prompt ?? '';
 
-      const [row] = await sql<Session[]>`
-        INSERT INTO sessions (project_id, name, model, system_prompt)
-        VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt})
-        RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
-      `;
+      const row = await sql.begin(async (tx) => {
+        const [session] = await tx<Session[]>`
+          INSERT INTO sessions (project_id, name, model, system_prompt)
+          VALUES (${req.params.id}, ${name}, ${model}, ${systemPrompt})
+          RETURNING id, project_id, name, model, system_prompt, created_at, updated_at
+        `;
+        await tx`
+          INSERT INTO session_panes (session_id, position, kind, state)
+          VALUES (${session!.id}, 0, 'chat', '{}'::jsonb)
+        `;
+        return session!;
+      });
       reply.code(201);
       return row;
     }