feat(settings): make non-WebUI sidebar session cap configurable

[fuzhyperblue]

Thinking Path

• Hermes WebUI already supports importing non-WebUI sessions (CLI/Telegram/Discord/etc.) into the sidebar.
• The imported-session cap is currently hardcoded (20) in both the state.db fetch path and the final sidebar visibility cap.
• Users with high-volume multi-surface workflows (especially CLI + cron + messaging) need this cap to be adjustable without patching Python constants.
• The codebase already has a proven settings pattern for numeric limits (pinned_sessions_limit).
• This PR applies that same pattern to non-WebUI session visibility while preserving legacy fallback behavior.

Contract Routing

Task type: small behavior extension (settings-backed numeric preference)
Touched areas: settings persistence, sidebar session merging/capping, settings UI, regression tests
Relevant public docs:

• AGENTS.md
• CONTRIBUTING.md
• docs/CONTRACTS.md
  Scope boundaries:
• No architecture/runtime-adapter changes
• No streaming/compression semantics changes
• No new dependencies
  Evidence needed before claiming done:
• settings key persisted via /api/settings
• sidebar cap resolves from settings with safe fallback
• regression tests for wiring + API range behavior

What Changed

Backend

• Added cli_session_limit to _SETTINGS_DEFAULTS in api/config.py (default 20).
• Added integer validation range in _SETTINGS_INT_RANGES (1..500).
• In api/models.py:
  • Added _cli_visible_session_limit() helper.
  • Replaced hardcoded state.db import limit with setting-based limit.
• In api/routes.py:
  • Added _resolve_cli_session_cap(settings) helper.
  • Replaced hardcoded final sidebar CLI cap with setting-based cap.

Frontend

• static/index.html: added a new number input in Settings:
  • id="settingsCliSessionLimit"
  • min=1, max=500
• static/panels.js:
  • load + autosave wiring for cli_session_limit
  • include value in payload for /api/settings
  • include value in full save flow
• static/boot.js:
  • bootstraps window._cliSessionLimit from settings

Tests

• Added tests/test_configurable_cli_session_limit.py:
  • verifies config/default/wiring strings
  • verifies /api/settings persistence and range behavior

Docs

• CHANGELOG.md updated under [Unreleased] with the new configurable setting.

Why It Matters

• Removes the need for local hardcoded patches to change non-WebUI sidebar visibility depth.
• Keeps default behavior unchanged for existing users (20).
• Aligns with existing settings architecture (same class as pinned_sessions_limit).

Verification

• pytest tests/test_configurable_cli_session_limit.py -v ✅
• pytest tests/test_configurable_pinned_sessions_limit.py -v ✅

Risks / Follow-ups

• This PR intentionally keeps a fallback constant path to avoid breakage if settings are missing/corrupt.
• If maintainers prefer i18n keys for the new label/description, we can add localized entries in a follow-up without changing runtime behavior.

Model Used

• Provider: custom (Hermes runtime)
• Model: deepseek-v4-flash-260425
• Notable tool use: terminal, file patch/write, pytest, GitHub API (fork + PR creation)