feat(sessions): indexação multi-fonte Hermes + OpenCode com fix TypeScript

- Novos indexadores hermes-indexer.ts e opencode-indexer.ts para unificar
  sessões Claude, Hermes Agent e OpenCode num único sessions.db
- SessionMeta alargado: source (obrigatório), model, input/output_tokens,
  estimated_cost; project_path/jsonl_path agora nullable
- Fix TS: tipos explícitos, guard jsonl_path null, dependências instaladas

Security Audit (Regra #47):
- npm audit executado — 0 vulnerabilities após fix
- vite 7→8.0.16 (breaking upgrade, resolve esbuild CVE GHSA-gv7w-rqvm-qjhr)
- vitest 4.0.18→4.1.9 (resolve esbuild interno CVE GHSA-gv7w-rqvm-qjhr)
- shell-quote override ^1.8.4 via package.json#overrides (CVE GHSA-w7jw-789q-3m8p)
- react-router, joi, qs, form-data, ip-address, js-yaml resolvidos via npm audit fix

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/services/sessions/parser.ts

@@ -186,9 +186,11 @@ export async function parseSessionFile(jsonlPath: string): Promise<ParseResult>
 
   const meta: SessionMeta = {
     session_id: sessionId,
+    source: 'claude',
     project_path: dirname(jsonlPath),
     project_slug: slugFromProjectPath(jsonlPath),
     jsonl_path: jsonlPath,
+    model: null,
     started_at: firstTs ?? new Date(stats.birthtimeMs).toISOString(),
     ended_at: lastTs,
     duration_sec: durationSec,
@@ -196,6 +198,9 @@ export async function parseSessionFile(jsonlPath: string): Promise<ParseResult>
     user_messages: userMessages,
     assistant_msgs: assistantMsgs,
     tool_calls: toolCalls,
+    input_tokens: null,
+    output_tokens: null,
+    estimated_cost: null,
     first_prompt: firstPrompt,
     tools_used: [...toolsUsed],
     skills_invoked: [...skillsInvoked],