Part of the #936 Effect-route migration. Moves the session message route
handlers off direct Session.* async calls onto AppRuntime.runPromise +
Effect.gen service access via Session.Service.

Change boundary:
- packages/opencode/src/server/instance/session.ts only: the GET messages
  handler (all three existing branches: limit undefined -> full list, limit 0 ->
  full list, limit > 0 -> messagesPage with the next-page Link header), the
  DELETE message part handler (removePart), and the PATCH message part handler
  (updatePart, with its body/param mismatch guard preserved before the runtime
  call). The undefined/0/positive branch structure and the pagination Link/cursor
  headers are kept 1:1 with dev; only the call sites are routed through the app
  runtime.
- test/server/session-messages.test.ts: adds a messages() helper and a new test
  exercising PATCH part (text before -> after) and DELETE part (returns true,
  resulting parts length 0).

Verification:
- Rebased onto latest origin/dev (clean, no conflict with #1024).
- test/server/session-messages.test.ts: 10 tests / 43 expects pass.
- tsgo typecheck clean.
- Independent `codex review --base origin/dev`: no actionable behavior-breaking
  issues; focused test + typecheck + git diff --check verified.
- Full PR CI green.

Review follow-up:
- Gemini medium (collapse the identical limit===undefined / limit===0 branches):
  kept the branch structure as-is. It is the pre-existing dev control flow and
  is correct (Session.messages treats a falsy limit as "return the full
  unpaginated list", so limit===0 is handled, not blocked); deduplicating it is
  an adjacent cleanup outside this behavior-preserving migration's scope.
  Resolved with rationale.

Residual risk: none beyond the migration itself; external route surface
unchanged and covered by tests.

Refs #936

Part of the #936 Effect-route migration. Moves the session core route handlers
off direct Session.* async calls onto AppRuntime.runPromise + Effect.gen service
access via Session.Service.

Change boundary:
- packages/opencode/src/server/instance/session.ts only: GET /session/:sessionID
  (get), GET /session/:sessionID/children, DELETE /session/:sessionID (remove),
  PATCH /session/:sessionID (update), and POST /session/:sessionID/fork. The
  PATCH update handler folds its get -> conditional setTitle/setPermission/
  setArchived -> re-get sequence into one Effect.gen, preserving the original
  order and the Permission.merge(current.permission ?? [], updates.permission)
  logic 1:1.
- Does NOT touch the prompt/respond, tool, turn-change, or force-delete handlers
  or their semantics; only the five core CRUD handlers above are routed through
  the app runtime.
- Adds test/server/session-core-routes.test.ts covering get/children/update/
  fork/delete, following the same run()/svc wrapper convention as the sibling
  session route test files.

Verification:
- Rebased onto latest origin/dev (clean, no conflict with #1023/#1024).
- Session route tests (core + messages + runtime-routes): 12 tests / 68 expects
  pass; no regression in the shared session.ts surface.
- tsgo typecheck clean.
- Independent `codex review --base origin/dev`: no regressions requiring a fix;
  focused + adjacent server/session/workspace tests + typecheck verified.
- Full PR CI green.

Review follow-up:
- Gemini medium (test-only: replace run()/svc wrapper with `const svc =
  SessionNs`): kept the wrapper, which is the established convention shared
  verbatim by the sibling session route tests already on dev; test-only, no
  production impact, suite passes. Resolved with rationale.

Residual risk: none beyond the migration itself; external route surface
unchanged and covered by tests.

Refs #936