feat: add bounded memory protection for session store

[pavelanni]

Summary

The in-memory session store (internal/session/store.go) has no limits on the number of sessions or messages per session. A misbehaving client could exhaust server memory.

What to add

• Max sessions: configurable limit (e.g., 1000), reject new sessions with an error when exceeded or evict LRU
• Max messages per session: configurable limit (e.g., 200 messages), trigger compaction or truncation when exceeded
• Session ID validation: currently truncated to 64 chars; consider restricting to alphanumeric + hyphens

Related

• Deferred from PR feat: add server-side session management for multi-turn conversations #51 (Kimi review finding MCP client integration for external tool servers #2)
• Part of Memory and context persistence #5 (Memory and context persistence)
• Max messages limit is a prerequisite for context compaction (Memory and context persistence #5 Phase 3)