refactor(session): remove legacy read surfaces

[LichKing-2234]

Summary

• remove legacy frontend /sessions routes, pages, and API client usage
• remove backend legacy session read endpoints and related tests
• keep the new attribution entrypoint as the formal user-facing surface

Test Plan

• cd backend && AE_TEST_POSTGRES_DSN='postgres://postgres:postgres@127.0.0.1:15432/postgres?sslmode=disable' go test ./internal/handler -count=1
• cd frontend && pnpm test

[Copilot]

Pull request overview

This PR completes the cut-over off the legacy "session read" UX. On the frontend it removes the /sessions list/detail pages, their tests, the @/api/session client wrapper, and the related TypeScript types, and reduces the Attribution landing page to a single tile. On the backend it removes the List, Get, and ProviderCredential session HTTP handlers (plus the helpers applyPublicUserSelect, requestedOwnerScope, and providerCredentialQuery), drops their routes from the router, removes the /session-usage-events and /session-events write routes, and deletes the associated handler/integration tests. Tests for those routes now assert 404. The isAdminUser helper is moved to a new auth_helpers.go, and a small session_test_helpers_test.go retains shared test fixtures. The ae-cli side stops forwarding PostCommit/PostRewrite events through the local proxy and removes the hidden ae-cli hook session-event subcommand. The plan doc is updated with Tasks 8–10 documenting the staged cutover.

Changes:

• Frontend: delete sessions pages/types/api/tests; collapse Attribution landing to a single tile; assert legacy routes are absent.
• Backend: remove session read endpoints, provider-credentials endpoint, and session usage/event write routes; prune related handler code and tests; extract isAdminUser.
• ae-cli: drop local-proxy event forwarding in hooks and remove the hook session-event subcommand and its tests.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
frontend/src/views/sessions/SessionListView.vue	Deleted legacy list page.
frontend/src/views/sessions/SessionDetailView.vue	Deleted legacy detail page.
frontend/src/views/attribution/AttributionLandingView.vue	Removed legacy-session tile and copy; single-column grid.
frontend/src/types/index.ts	Removed Session, edge types, and SessionListParams.
frontend/src/router/index.ts	Removed /sessions and /sessions/:id routes.
frontend/src/api/session.ts	Deleted API wrapper.
frontend/src/tests/session-list-view.test.ts	Deleted tests for removed view.
frontend/src/tests/session-detail-view.test.ts	Deleted tests for removed view.
frontend/src/tests/router.test.ts	Replaced session-route assertions with negative assertion.
frontend/src/tests/api-modules.test.ts	Removed listSessions API test.
docs/superpowers/plans/2026-05-14-legacy-session-staged-cutover.md	Added Tasks 8–10 covering the cutover.
backend/internal/handler/session.go	Removed List, Get, ProviderCredential handlers and helpers.
backend/internal/handler/router.go	Removed session read routes, provider-credentials, and usage/event write routes.
backend/internal/handler/auth_helpers.go	Extracted isAdminUser helper.
backend/internal/handler/session_test_helpers_test.go	New shared test helpers (createOwnedSessionForUser, fullAdminUserID).
backend/internal/handler/session_usage_test.go	Replaced positive tests with 404 assertions.
backend/internal/handler/session_bootstrap_http_test.go	Removed ProviderCredential HTTP test and unused import.
backend/internal/handler/session_detail_http_test.go	Deleted entire file.
backend/internal/handler/handler_extended_test.go	Removed List/Get session tests.
backend/internal/handler/handler_90_test.go	Removed list/get steps from full lifecycle test.
backend/internal/handler/handler_final_coverage_test.go	Removed pagination edge-case test for list.
ae-cli/internal/hooks/handler.go	Removed local-proxy PostEvent calls from PostCommit/PostRewrite.
ae-cli/internal/hooks/handler_test.go	Removed proxy-forwarding tests and helpers.
ae-cli/cmd/hook.go	Removed hidden session-event subcommand.
ae-cli/cmd/hook_test.go	Removed test asserting session-event subcommand exists.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.