feat(web): add turn-scoped cancellation

[testikun]

Problem

OpenPI Web has no way to stop the currently running provider turn without stopping the Host. A browser also needs an exact, reconnect-safe identity for the turn it intends to cancel so that a stale tab cannot abort a newer turn.

Closes #342.

Value

Users can stop a long or unwanted Web response while preserving the Host, Session, and already-admitted follow-ups. The result is derived from Pi's canonical lifecycle rather than optimistic browser state, so refreshes, reconnects, retries, and multiple clients converge on the same outcome.

Approach

• Project each active turn as { sessionId, commandId, epoch } in snapshots and turn_started events.
• Add a lease-sensitive POST /api/turns/cancel endpoint whose receipt distinguishes accepted, already-settled, stale-session, stale-turn, and failed.
• Revalidate the complete turn identity inside the runtime's serialized mutation boundary, invoke Pi's native AgentSession.abort(), and wait for the canonical assistant terminal message before reporting success.
• Keep accepted follow-ups queued, make repeated requests idempotent, bound retained terminal identities, and prevent stale requests from reaching a newer turn.
• Show Stop only for the canonical active turn. The browser does not optimistically return to idle; it waits for turn_settled(outcome=cancelled). Refresh and SSE reconnect recover the control from the snapshot.
• Record the protocol and ownership boundary in docs/development/OPENPI_WEB_DEVELOPMENT.md and link it back to feat(web): support Pi-native turn interrupt and cancellation #342.

Validation

• bun run check — passed.
• bun run test — Node tests: 1246 passed, 0 failed, 1 skipped; Vitest: 30 passed.
• Targeted Web cancellation tests — 78 passed, covering exact/idempotent/stale/native-failure/queued runtime behavior, endpoint mapping, snapshots, unbound workspaces, UI non-optimism, reconnect recovery, and controls.
• Real local UI test through the production openpi web CLI and real PiWebRuntime / WebHost: an actual outbound provider request produced turn_started; Stop invoked native abort; Pi emitted stopReason: aborted; the Host emitted canonical turn_settled(outcome=cancelled) and an accepted receipt; Send was restored. The first claim comment contains the real screenshot and full evidence.

Impact

• User-visible: Web gains a Stop button during an active turn and a localized cancellation terminal message.
• Model-visible context/tools: none.
• Runtime/lifecycle: adds turn-scoped cancellation while leaving Host disposal and global pause semantics unchanged.
• Persisted config/data: none; active-turn identity is transient snapshot/event state.
• Compatibility/risk: protocol additions are backward-compatible. Cancellation fails closed on stale identity, native abort failure, or Host shutdown, with regression coverage for queued work and reconnects.

[testikun]

CI status note: Node 22/24 completed this PR's repository checks and failed only at the final fresh-install Smoke-test packed standalone Web CLI step, where the child exits before the test can read its URL. The same failure now occurs on unrelated PRs #385, #386, and #387.

I reproduced the packed install independently: npm now admits Pi 0.85.0 through OpenPI's published peerDependencies: "*"; the CLI then exits with Cannot find module '@earendil-works/pi-server'. The checkout/lock-based bun run check and full test suite remain green. I recorded the shared packaging regression and suggested peer-range follow-up in #328: #328 (comment)

No dependency workaround is mixed into this feature PR.

[tt-a1i]

方向对，有一处应修；请用这份替换 #358

turn 范围（sessionId+commandId+epoch）、等 turn_settled(outcome=cancelled)、不乐观结算，这些都符合合同。#358 从 abort() 返回值推断取消，请关掉那份。

应修：cancelActiveTurn 里 Promise.race([settlement, abortFailure])。如果 abort() resolve 了，但又没有 assistant message_end，HTTP 会一直挂着（没有超时）。请给 settlement 加界，或把「abort 成功但未结算」变成明确的非终态/错误，而不是挂起。

CI 红是共享的打包 openpi web 冒烟，不是这份 diff 独有的。

[tt-a1i]

需要改：abort() 成功但没有 message_end 时 HTTP 会一直挂

上一评写成 COMMENT 偏软。cancelActiveTurn 里：

const abortFailure = new Promise<never>((_, reject) => {
  void abortOperation.catch(reject);
});
const terminal = await Promise.race([settlement, abortFailure]);

abort() resolve、又没有 assistant message_end 时，settlement 永不 settle，abortFailure 也不 reject，HTTP 无限等。这是取消合同上的无界挂起，合入前要加超时或明确的非终态/错误。

方向仍对：sessionId+commandId+epoch、等 turn_settled、替换 #358。CI 红仍是共享打包冒烟。