feat(backend): rename/group/archive/unarchive/delete/documents routes + resume read-only guard

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/app.ts

@@ -26,7 +26,7 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   app.register(cors, {
     origin: true,
     credentials: true,
-    methods: ["GET", "POST", "PUT", "OPTIONS"],
+    methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
   });
 
   const tht = deps?.thtRunner ?? new ThtRunner({

backend/src/routes/sessions.ts

@@ -48,6 +48,10 @@ export function sessionRoutes(
   });
   app.post("/sessions/:id/resume", async (req, reply) => {
     const id = (req.params as any).id;
+    const manifest = (await d.tht.sessionShow(id)) as { status?: string; archived?: boolean } | null;
+    if (manifest?.status === "finalized" || manifest?.archived) {
+      return reply.code(409).send({ error: "sessione in sola lettura (finalizzata o archiviata)" });
+    }
     const rt = await d.mgr.resume(id, d.tht);
     rt.bridge.onClientEvent((e) => d.hub.publish(id, e.type, e));
     return reply.code(200).send({ id });
@@ -73,4 +77,27 @@ export function sessionRoutes(
     const off = d.hub.subscribe(id, send, rt?.bridge.pendingWidget() ?? null);
     req.raw.on("close", off);
   });
+  app.post("/sessions/:id/rename", async (req, reply) => {
+    await d.tht.setName((req.params as any).id, (req.body as any).name);
+    return reply.code(204).send();
+  });
+  app.post("/sessions/:id/group", async (req, reply) => {
+    await d.tht.setGroup((req.params as any).id, (req.body as any).group);
+    return reply.code(204).send();
+  });
+  app.post("/sessions/:id/archive", async (req, reply) => {
+    await d.tht.archive((req.params as any).id);
+    return reply.code(204).send();
+  });
+  app.post("/sessions/:id/unarchive", async (req, reply) => {
+    await d.tht.unarchive((req.params as any).id);
+    return reply.code(204).send();
+  });
+  app.delete("/sessions/:id", async (req, reply) => {
+    const id = (req.params as any).id;
+    d.mgr.teardown(id); // drop any live runtime before deleting on disk
+    await d.tht.deleteSession(id);
+    return reply.code(204).send();
+  });
+  app.get("/sessions/:id/documents", async (req) => d.tht.documents((req.params as any).id));
 }