feat(web): D4 会话未读徽标 — 打开即已读 + 消费 session_read

- SessionMeta.unreadCount（可选，兼容旧后端）+ api/sessions.markSessionRead
- lib/sessionRead.ts：会话历史落地后再推游标（best-effort，失败静默，下次 GET /sessions 收敛）+ 帧归属判定（ws.ts 因此留在 500 行内）
- store.clearUnread 无变化时返回同一 state，避免多余重渲染；Nav 徽标沿用 Miuix token（mu-radius-pill/mu-err/mu-rise-in）
- 逻辑测试 35 → 54 项，含变异校验（改成 clearUnread(activeSessionId) 即 FAIL）

frontend/web/src/lib/api/sessions.ts

@@ -84,3 +84,20 @@ export function deleteSession(
     { method: "DELETE" }
   );
 }
+
+/** POST /api/v1/sessions/{id}/read — advance this account's read cursor for the
+ *  session to `before` (ms since epoch; omitted = "now"). One cursor per session,
+ *  forward only: a stale client can never re-open messages as unread. Unknown
+ *  session → 404 (ApiError). */
+export function markSessionRead(
+  sessionId: string,
+  before?: number
+): Promise<{ sessionId: string; readAt: number }> {
+  return request<{ sessionId: string; readAt: number }>(
+    `/sessions/${encodeURIComponent(sessionId)}/read`,
+    {
+      method: "POST",
+      body: JSON.stringify(before === undefined ? {} : { before }),
+    }
+  );
+}