feat(history): 会话消息持久化 + 主/次级会话（design/16）

- runtime/history: Store + HistoryStore 接口（Append/List 游标分页/Recent/DeleteSession/NewSubSession/ListSessions），主会话固定 web、次级 web:<uuid>
- db 迁移 0003: chat_sessions + chat_messages + idx_chat_msgs_session_created（事务幂等）
- gateway: GET/POST /sessions、GET /sessions/{id}/messages 热分页、DELETE /sessions/{id}（主不可删 403）；Deps.History 可空注入
- 编排层落库: session_persist.go（submitInternal 写用户消息、completeTurn 写助手消息，拒绝的消息不落库）
- WS: wsEvent 加 sessionId 定向 + history 回放帧（握手上行后回放主会话最新 50 条，thinking 剥离）
- wire.go 装配 History 到 gateway.Deps.History
- 端到端实测: POST /sessions 建次级 201 / GET /sessions 列表 / POST /chat 后 /messages 读到 user+assistant / DELETE 次级成功 / DELETE 主会话 403

internal/services/gateway/session_orchestrator.go

@@ -104,6 +104,10 @@ type OrchestratorOptions struct {
 	Log        *slog.Logger
 	MaxPending int
 	MaxTail    int
+	// History is the optional persistent chat-history store (design/16 §3.3).
+	// When nil every Append is skipped, so the orchestrator runs without storage
+	// (tests / a gateway built without a history store).
+	History HistoryStore
 }
 
 // sessionState is the per-session message state (design/15 §2). Every mutation
@@ -135,6 +139,7 @@ type Orchestrator struct {
 	run        TurnRunner
 	emit       StateSink
 	log        *slog.Logger
+	history    HistoryStore
 	maxPending int
 	maxTail    int
 }
@@ -160,6 +165,7 @@ func NewOrchestrator(opts OrchestratorOptions) *Orchestrator {
 		run:        opts.Run,
 		emit:       opts.Emit,
 		log:        opts.Log,
+		history:    opts.History,
 		maxPending: maxPending,
 		maxTail:    maxTail,
 	}
@@ -212,6 +218,7 @@ func (o *Orchestrator) submitInternal(ctx context.Context, sessionID string, mes
 		depth := len(st.pending)
 		mode := st.mode
 		o.mu.Unlock()
+		o.persistUserMessages(ctx, sessionID, messages)
 		o.emitState(sessionID, EventPendingAck, map[string]any{"sessionId": sessionID, "mode": mode, "queueDepth": depth})
 		return SubmitResult{Accepted: true, Pending: true, QueueDepth: depth}, nil
 	}
@@ -225,6 +232,7 @@ func (o *Orchestrator) submitInternal(ctx context.Context, sessionID string, mes
 	o.mu.Unlock()
 
 	o.emitState(sessionID, EventSessionBusy, map[string]any{"sessionId": sessionID, "mode": ModeThinking})
+	o.persistUserMessages(ctx, sessionID, messages)
 
 	if sync {
 		res, err := o.run(runCtx, sessionID, messages, env)
@@ -257,6 +265,7 @@ func (o *Orchestrator) goTurn(sessionID string, gen uint64, messages []model.Mes
 // (design/15 §2.2: incremental, not full replay). A stale generation (an
 // interrupt or a newer top-level turn superseded this one) is a no-op.
 func (o *Orchestrator) completeTurn(sessionID string, gen uint64, res *loop.Result, runErr error) error {
+	o.persistAssistantReply(sessionID, res)
 	o.mu.Lock()
 	st := o.states[sessionID]
 	if st == nil || st.gen != gen {