Adds /api/sessions/:id/panes (GET, POST), /api/panes/:id (PATCH, DELETE) with transactional position-shift logic (negate-and-restore pattern to avoid UNIQUE collisions). Max 5 panes per session enforced. Sessions.POST now creates the session and a default Chat pane at position 0 atomically via sql.begin.