fix(web): usable past-conversation list, and search that finds past sessions

Two home-screen reports from @jordan8037310, both about history that is
present but unreachable.

#260 — "Resume Conversation" rendered 4 rows, then a button that appended
every remaining row into a `max-height: 240px` box, so 35 conversations
landed in a four-row scroll well with no ordering or filtering. Rendering
now goes through `_renderHistoryList()` over a cached corpus: 10 rows to
start, Show more/Show less that grows and shrinks the box (the height cap
is class-driven, `.history-list.expanded`), plus a filter box (name,
folder, #case label, prompts), a sort control (recent / name / folder,
pinned rows still first) and a shown-of-total count. A filter implies
expansion, so every match is visible, and the whole header hides as one
unit while a federated search is active. The A-Z sort keys off the same
string the row renders, since most rows are transcript-backed and carry
no session name at all.

#261 — the search box could not match a past project by folder name:
`harvestSources()` built its session corpus from the live in-memory map,
while past sessions come from `/api/sessions/unified` (lifecycle log +
transcript scan). Folding that scan into the request path would have cost
the search its no-filesystem-reads property, so the corpus arrives via a
bounded snapshot instead: `session-history-index.ts` is published as a
side effect of `/api/sessions/unified` (the home screen fetches it on
open, which is the same screen the search box lives on) and rebuilt
fire-and-forget, single-flight and TTL-guarded when a search finds it
stale. A result for a closed session now resumes the conversation rather
than selecting a tab that no longer exists, and is badged RESUME.

The snapshot is stored unscoped with a per-row owner and re-filtered
through canAccessOwned() on read, so multi-user sees exactly what
/api/sessions/unified exposes: own sessions only, host-wide transcript
history admin-only. Live rows are harvested first and win the dedupe.

Verified end-to-end against a real instance with 60 past sessions: cold
process answers its first search without history and its second with it;
folder-name queries return resume targets; clicking one posts the right
resumeSessionId + workingDir.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/search-service.test.ts

@@ -233,3 +233,61 @@ describe('searchSources — result card shape & path safety', () => {
     expect(searchSources('', data).totalResults).toBe(0);
   });
 });
+
+// Past sessions (issue #261). The corpus used to be the live session map alone,
+// so a folder in the home screen's Resume list matched nothing. History rows now
+// arrive marked, and a card for one has to RESUME the conversation — selecting a
+// tab that no longer exists is a no-op the user reads as a broken result.
+describe('searchSources — past (history) sessions', () => {
+  it('matches a past session by folder name and returns a resume jump target', () => {
+    const data = sources({
+      sessions: [
+        {
+          sessionId: 'cod-1',
+          sessionName: 'w3-invoices',
+          workingDir: '/home/u/projects/invoices',
+          timestamp: 500,
+          history: true,
+          claudeSessionId: 'claude-uuid-1',
+        },
+      ],
+    });
+    const res = searchSources('invoices', data);
+    expect(res.totalResults).toBe(1);
+    expect(res.groups[0].results[0].jumpTo).toEqual({
+      kind: 'resume-session',
+      sessionId: 'cod-1',
+      claudeSessionId: 'claude-uuid-1',
+      workingDir: '/home/u/projects/invoices',
+    });
+  });
+
+  it('keeps a live session on the plain session jump target', () => {
+    const data = sources({
+      sessions: [{ sessionId: 'live-1', sessionName: 'w1-invoices', workingDir: '/home/u/invoices', timestamp: 1 }],
+    });
+    expect(searchSources('invoices', data).groups[0].results[0].jumpTo).toEqual({
+      kind: 'session',
+      sessionId: 'live-1',
+    });
+  });
+
+  it('does not offer a resume for a history row with no working directory', () => {
+    const data = sources({
+      sessions: [{ sessionId: 'cod-2', sessionName: 'needle-run', workingDir: '', timestamp: 1, history: true }],
+    });
+    // Nothing to resume INTO — a resume card here would always fail.
+    expect(searchSources('needle', data).groups[0].results[0].jumpTo.kind).toBe('session');
+  });
+
+  it('falls back to the folder basename when a transcript row has no name', () => {
+    const data = sources({
+      sessions: [
+        { sessionId: 'cod-3', sessionName: '', workingDir: '/home/u/proj/needle-app', timestamp: 1, history: true },
+      ],
+    });
+    const r = searchSources('needle', data).groups[0].results[0];
+    expect(r.sessionName).toBe('needle-app');
+    expect(r.snippet).toContain('/home/u/proj/needle-app');
+  });
+});