chore: hygiene pass — ruff clean, docs storage-model truth, replay /me, failSession log

Audit findings 6.1-6.4 + the audit's remediation plan itself
(docs/superpowers/plans/2026-07-20-full-audit-remediation-plan.md).

- ruff: 34 → 0 (unused imports/f-strings auto-fixed; E702 semicolon lines
  split in test files; one unused local dropped). Suite still 819 green.
- CLAUDE.md + PROJECT_STATE.md no longer claim "no database / settings in
  settings.json": the harness selects filesystem OR PostgreSQL session
  storage (repository.py, server mode), and settings flow through harness
  preferences with the JSON file as fallback only.
- tools/replay: stub /me (SPA boot was parsing the SPA's own HTML as JSON)
  and /runtime/prewarm.
- failSession best-effort persistence now logs its failure server-side
  instead of vanishing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

PROJECT_STATE.md

@@ -346,8 +346,11 @@ All three layers' deps installed (`npm install` in each, `python -m venv + pip i
   repo `tht-workspace-psd/`, NOT committed here).
 - Secrets live ONLY in `harness/.env` (gitignored; `THT_*` — DB, DWH REST, vector, SSL CA…).
   See `harness/.env.example` for the variable list.
-- App settings (global): `backend/data/settings.json` (gitignored) — `{ workspace, provider,
-  model, thinking }`. The "New session" form is question-only; these settings supply the rest.
+- App settings (global): `{ workspace, provider, model, thinking }`, persisted via harness
+  preferences (`tht session preferences get/set` → the configured session repository —
+  filesystem or Postgres in server mode). `backend/data/settings.json` (gitignored) remains
+  only the file fallback for injected runners/tests. The "New session" form is question-only;
+  these settings supply the rest.
 
 ## Efficiency levers (NL→SQL workflow optimization, 2026-07-08)