chore: hygiene pass — ruff clean, docs storage-model truth, replay /me, failSession log

Audit findings 6.1-6.4 + the audit's remediation plan itself
(docs/superpowers/plans/2026-07-20-full-audit-remediation-plan.md).

- ruff: 34 → 0 (unused imports/f-strings auto-fixed; E702 semicolon lines
  split in test files; one unused local dropped). Suite still 819 green.
- CLAUDE.md + PROJECT_STATE.md no longer claim "no database / settings in
  settings.json": the harness selects filesystem OR PostgreSQL session
  storage (repository.py, server mode), and settings flow through harness
  preferences with the JSON file as fallback only.
- tools/replay: stub /me (SPA boot was parsing the SPA's own HTML as JSON)
  and /runtime/prewarm.
- failSession best-effort persistence now logs its failure server-side
  instead of vanishing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/routes/sessions.ts

@@ -98,7 +98,11 @@ export function sessionRoutes(
               // old failure must not touch its manifest.
               const bound = boundRuntimes.get(id);
               if (bound !== undefined && bound !== rt) return;
-              await runner.failSession(id, workspace).catch(() => undefined);
+              // Best-effort by design (crash path), but a storage outage must be
+              // visible server-side: the manifest stays open and resume remains legal.
+              await runner.failSession(id, workspace).catch((error: unknown) => {
+                console.error(`[session:${id}] failSession persistence failed:`, error);
+              });
             }).catch(() => undefined);
           }
         }