feat(backend): session routes + SSE + response/steer wiring

Make buildApp injectable (deps.thtRunner + deps.spawnFn); create
src/routes/sessions.ts with all 7 session routes under authPreHandler;
wire bridge.onClientEvent→hub.publish before returning {id} from POST
/sessions; SSE subscribes with pendingWidget safety net.

18/18 tests pass, tsc clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/app.ts

@@ -1,7 +1,30 @@
 import Fastify, { type FastifyInstance } from "fastify";
 import type { AppConfig } from "./config.js";
-export function buildApp(_config: AppConfig): FastifyInstance {
+import { ThtRunner } from "./tht/tht-runner.js";
+import { PiProcessManager } from "./pi/pi-process-manager.js";
+import { SseHub } from "./sse/sse-hub.js";
+import { authPreHandler } from "./auth/auth.js";
+import { sessionRoutes } from "./routes/sessions.js";
+
+export interface BuildAppDeps {
+  thtRunner?: ThtRunner;
+  spawnFn?: () => any;
+}
+
+export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstance {
   const app = Fastify({ logger: false });
+
+  const tht = deps?.thtRunner ?? new ThtRunner({
+    thtBin: config.thtBin,
+    harnessDir: config.harnessDir,
+    configPath: "config/tht.yaml",
+  });
+  const mgr = new PiProcessManager(config, deps?.spawnFn ? { spawnFn: deps.spawnFn } : undefined);
+  const hub = new SseHub();
+
+  app.addHook("preHandler", authPreHandler(config.authMode));
   app.get("/health", async () => ({ status: "ok" }));
+  sessionRoutes(app, { mgr, tht: tht as ThtRunner, hub });
+
   return app;
 }