fix(store): add 14-day retention for the sessions/ directory (#949)

[hakanbaysal]

What / Why / How

Fixes #949.

content/ has pruned stale per-project DBs at 14 days since day one, but
sessions/ had no retention path at all: per-session stats-*.json files
(one per server process, never reread once the session ends) and idle
per-project session DBs accumulate without bound. The issue reports a
two-month heavy install at 5,294 files / ~331MB in sessions/ while
content/ stayed bounded at ~52MB.

Fix: add cleanupStaleSessionFiles(sessionsDir, maxAgeDays) next to
cleanupStaleContentDBs and run it in the same one-time startup cleanup cycle,
with the same 14-day window.

Two deliberate design points:

• Purely mtime-based. Every hook write refreshes the DB mtime, so a file
  untouched for 14 days cannot belong to a live session. No WAL-staleness
  liveness guess — that heuristic can delete files under a live handle ([Bug]: cleanupStaleContentDBs race with parallel Pi MCP servers poisons ContentStore singleton (permanent disk I/O error) #880),
  so the sessions variant does not inherit it.
• Conservative file matching. Only *.db (with their -wal/-shm
  siblings) and stats-*.json are considered; unknown file types in the
  directory are never touched.

Note: pruning old stats-*.json slightly reduces the Pi lifetime byte
aggregation (patchPiLifetimeFromStatsFiles sums all stats files) — the same
class of trade-off the existing 14-day content/ pruning already makes.

Affected platforms

• All platforms

Test plan

• 3 new tests in the existing "DB Cleanup" describe: stale DB trio + stale
  stats removed while fresh files and unknown types are kept; a fresh DB with
  a stale-looking WAL is kept (no WAL heuristic, regression guard for the [Bug]: cleanupStaleContentDBs race with parallel Pi MCP servers poisons ContentStore singleton (permanent disk I/O error) #880
  class); missing directory returns 0.
• npx vitest run tests/store.test.ts → 126 passed;
  npx vitest run tests/core/server.test.ts → 499 passed.
• npx tsc --noEmit → clean.

Checklist

• Tests added/updated (TDD: red → green)
• npm test passes (store + server suites; full build requires Node >=22.5)
• npm run typecheck passes
• Docs updated if needed — n/a
• No Windows path regressions (join() throughout, no hardcoded separators)
• Targets next branch