Add API for externally launching agent sessions

[Mbeaulne]

Closes Shopify/oasis-frontend#688

Description

Adds a dedicated API for trusted external systems to create a bundle-backed Tangent session and immediately send its first prompt to Prime.

• Adds POST /api/session-launches with required bundleId and prompt fields.
• Returns the new sessionId without exposing internal workspace details.
• Reuses the same provisioning path as interactive session creation.
• Persists the initial human message before dispatching it to Prime.
• Preserves bundle configuration, welcome messages, triggers, and user context.
• Rolls back the session record, workspace, triggers, and agent processes if provisioning fails.
• Documents that machine authentication belongs at the deployment ingress or service proxy.

Screenshots

N/A — server API only.

How to test

pnpm --filter @tangent/server test
pnpm validate

With the server running and the deployment ingress configured, call:

curl -u "$INGRESS_USERNAME:$INGRESS_PASSWORD" \
  -H "content-type: application/json" \
  -d '{"bundleId":"tangle-oss","prompt":"Investigate the latest failed run"}' \
  https://<deployment>/api/session-launches

Verify the response is 201 Created with a sessionId, then open /sessions/<sessionId> and confirm the prompt is present and Prime begins processing it.

Notes

The application does not store shared machine credentials. Basic Auth and any additional deployment-specific authentication headers must be configured outside this repository at the ingress or service-proxy layer.