feat(web): add self-hosted Session connection flow

[sam2tom]

Summary

• add one shared, admission-aware Start Session flow for environment:none and the explicitly enabled Codex self_hosted profile
• validate the executor-host Workspace and keep Session creation idle, idempotent, and fail-closed
• render secret-free native and optional local Docker connection commands from the complete Core-returned Environment projection
• move Environment status and setup into a header dialog beside the separately labelled Live events state
• show an immediate pending user message while Core accepts a send, without adding automatic retries
• update protocol/connection documentation and pin conclusions to Parsar 2b34ea4630a5a0daf90e745fe1af3edcfa4f0e9e

Validation

• pnpm check (root 67, client 50, Web 401; build passed)
• pnpm test:acceptance (46/46)
• git diff --check
• local real-Core UI acceptance for Session/Environment connection state; no paid model Turn was sent

Closes #28