feat(web): expose Pi-native turn cancellation

[seekskyworld]

Problem

Implements the first runtime slice of #342. The Web host had no per-turn cancellation endpoint and could only abort sessions during host disposal.

Value

A browser client can request cancellation without tearing down unrelated Web runtime state, while stale Session requests are rejected.

Approach

Add an optional interruptTurn controller seam backed by Pi AgentSession.abort(). Bind the request to the active Session id, return cancelled or already_settled, emit a cancellation event, and expose POST /api/prompt/cancel. Existing test doubles remain compatible through the optional interface member.

Validation

• npx tsc --noEmit
• node --test --experimental-strip-types tests/web/pi-runtime.test.ts tests/web/web-host.test.ts (39 passed)
• git diff --check

Impact

• User-visible behavior: adds a server cancellation seam; UI control wiring remains a follow-up.
• Model-visible context/tools: none.
• Runtime/lifecycle: per-turn abort is distinct from host disposal and uses Pi lifecycle.
• Persisted config/data: none.
• Compatibility/risk: old controllers without the optional seam receive a bounded 501 response.

[tt-a1i]

需要改：用 abort() 返回值当取消完成

interruptTurn 在 await abort() 之后立刻发 prompt_cancelled 并返回 cancelled，没有等 Pi 的 stopReason: "aborted"。这是从调用结果推断完成，违反「不要从标签/调用返回值推断完成」。

另外没有 commandId / epoch：同一 session 上，过期客户端可以取消更新的 turn。preparing/queued 走 already_settled no-op。

同 issue 的 #385 才是 turn 范围的回执（sessionId+commandId+epoch，等 turn_settled）。请关掉本 PR，或 rebase 成那份合同。不要再叠 #357 的 capability-intent 改动。