feat(session,web): 会话角色不可变 — PATCH 拒 personaId + 移除前端换角色入口

design/22 §8-1（主人 2026-10-03 拍板）：会话角色在创建时确定、之后不可变，
要换角色必须新开会话。

后端：
- PATCH /api/v1/sessions/{id} 的 personaId 改为 json.RawMessage 判「键出现」，
  出现即 400（null/""/未知 id 一律拒），且先于会话存在性检查；错误消息点名 personaId
- 删除 Server.setSessionPersona 与 PATCH 的 501 分支；title/pinned 行为逐字不变
- sessionPersonaWriter 接口与 history.Store.SetSessionPersona 保留（存储能力）

前端：
- 移除会话行「切换角色」入口与面板「挂角色」下拉（含 setSessionPersona action、
  lib/sessionPersona.ts）；保留「新建会话选角色」；面板「角色」列改为只读展示

契约：Docs/api-client.md -> v0.46（破坏性：依赖 PATCH 换角色的客户端须改为新建会话）

验证：go build/vet ./... 绿；gateway+history 包测试绿（-count=1）；前端 npm run build
（tsc --noEmit + vite build）绿；9 个前端逻辑测试全绿。
变异验证：改回「静默忽略」/「写绑定」两种反向实现，新断言均 FAIL。

internal/services/gateway/persona_env.go

@@ -43,10 +43,13 @@ type sessionPersonaReader interface {
 	SessionPersona(ctx context.Context, sessionID string) (string, error)
 }
 
-// sessionPersonaWriter is the optional narrower view of HistoryStore used to rebind
-// a session's role (PATCH /sessions/{id}, design/22 §4.5). *history.Store
-// implements it; a store without it answers 501 on a persona write rather than
-// pretending the binding landed.
+// sessionPersonaWriter is the optional narrower view of HistoryStore for writing a
+// session's role binding. A session's role is decided at creation (design/22 §8-1),
+// so no request path rebinds one any more — creation goes through subSessionCreator —
+// and the gateway no longer type-asserts this interface. It stays next to the reader
+// and the creator so the store's role-binding surface is documented in one place:
+// *history.Store still implements SetSessionPersona (design/22 §4.1) and the
+// admin/owner write path that would use it is a separate endpoint, not a PATCH.
 type sessionPersonaWriter interface {
 	SetSessionPersona(ctx context.Context, sessionID, personaID string) error
 }