feat: establish unified administration and model context baseline

frontend/src/api/sessions.ts

@@ -26,11 +26,12 @@ async function selectedPreferences(precondition?: AuthOperationPrecondition): Pr
   // application memory from the installation defaults once, then keep choices ephemeral.
   const legacy = await getSettings();
   requireAuthOperationPrecondition(precondition);
+  const latest = workspacePreferences.load();
   return workspacePreferences.save({
-    workspaceId: saved.workspaceId ?? legacy.workspace,
-    provider: saved.provider ?? legacy.provider,
-    model: saved.model ?? legacy.model,
-    thinking: saved.thinking ?? legacy.thinking,
+    workspaceId: latest.workspaceId ?? legacy.workspace,
+    provider: latest.provider ?? legacy.provider,
+    model: latest.model ?? legacy.model,
+    thinking: latest.thinking ?? legacy.thinking,
   });
 }
 
@@ -139,8 +140,20 @@ export const postSteer = (id: string, text: string) =>
 export const closeSession = (id: string) =>
   apiFetch<void>(`/sessions/${id}/close`, { method: "POST" });
 
-export const resumeSession = (id: string) =>
-  apiFetch<ResumeSessionResult>(`/sessions/${id}/resume`, { method: "POST" });
+export async function resumeSession(id: string) {
+  const operation = captureAuthOperation();
+  const precondition = operation ? {
+    operation,
+    isCurrent: () => isAuthOperationCurrent(operation, { sessionId: null, disposalEpoch: operation.disposalEpoch }),
+  } : undefined;
+  const selected = await selectedPreferences(precondition);
+  requireAuthOperationPrecondition(precondition);
+  return apiFetch<ResumeSessionResult>(`/sessions/${id}/resume`, {
+    method: "POST",
+    // The workspace is owned by the persisted session, never by this request.
+    body: JSON.stringify({ provider: selected.provider, model: selected.model }),
+  });
+}
 
 export const renameSession = (id: string, name: string) =>
   apiFetch<void>(`/sessions/${id}/rename`, { method: "POST", body: JSON.stringify({ name }) });