Add web session creation API and UI flow

[Codex]

Web users could not start sessions without CLI access; add a browser-driven flow plus supporting APIs for session lifecycle.

• API — New POST /api/sessions validates name/metadata, scaffolds session directories, returns SessionMeta; 409 on duplicates, 422 on invalid names. Close/delete now return JSON, heartbeat helper added, asset upload/serve endpoints hardened, TLS options exposed on create_server.
• Session model — SessionMeta gains target; create_session_scaffold() centralizes creation with HMAC/encryption keys and metadata validation; asset path validation tightened.
• Web UI — Index page adds “New Session” modal and live session cards with close/delete; session page shows heartbeat badge, upload dropzone, and uses JS to update session list/status safely.
• CLI/Docs — gscroll serve reports port-in-use clearly; README documents new endpoints, metadata fields, and binding/TLS notes; tests updated for new shapes and metadata.

Example:

curl -X POST http://localhost:1551/api/sessions \
  -H 'Content-Type: application/json' \
  -d '{"name":"htb-machine","operator":"alice","target":"10.10.11.1"}'
# -> 201 {"session": {...}, "status": "active", "url": "/session/htb-machine"}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.