feat(sessions): indexação multi-fonte Hermes + OpenCode com fix TypeScript

- Novos indexadores hermes-indexer.ts e opencode-indexer.ts para unificar
  sessões Claude, Hermes Agent e OpenCode num único sessions.db
- SessionMeta alargado: source (obrigatório), model, input/output_tokens,
  estimated_cost; project_path/jsonl_path agora nullable
- Fix TS: tipos explícitos, guard jsonl_path null, dependências instaladas

Security Audit (Regra #47):
- npm audit executado — 0 vulnerabilities após fix
- vite 7→8.0.16 (breaking upgrade, resolve esbuild CVE GHSA-gv7w-rqvm-qjhr)
- vitest 4.0.18→4.1.9 (resolve esbuild interno CVE GHSA-gv7w-rqvm-qjhr)
- shell-quote override ^1.8.4 via package.json#overrides (CVE GHSA-w7jw-789q-3m8p)
- react-router, joi, qs, form-data, ip-address, js-yaml resolvidos via npm audit fix

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/types/session.ts

@@ -2,9 +2,11 @@ export type SessionOutcome = 'completed' | 'interrupted' | 'error' | 'unknown'
 
 export interface SessionMeta {
   session_id: string
-  project_path: string
-  project_slug: string
-  jsonl_path: string
+  source: 'claude' | 'hermes' | 'opencode'
+  project_path: string | null
+  project_slug: string | null
+  jsonl_path: string | null
+  model: string | null
   started_at: string
   ended_at: string | null
   duration_sec: number | null
@@ -12,6 +14,9 @@ export interface SessionMeta {
   user_messages: number
   assistant_msgs: number
   tool_calls: number
+  input_tokens: number | null
+  output_tokens: number | null
+  estimated_cost: number | null
   first_prompt: string | null
   tools_used: string[]
   skills_invoked: string[]