Add API for externally launching Tangent sessions

[Mbeaulne]

Summary

closes: https://github.com/Shopify/oasis-frontend/issues/688
Adds an external API for creating a bundle-backed Tangent Shell session and immediately submitting its initial prompt.

External systems such as Quick can call:

POST /api/session-launches
Content-Type: application/json

{
  "bundleId": "tangle-oss",
  "prompt": "Investigate the latest failed run"
}

Successful requests return:

{
  "sessionId": "..."
}

Implementation

• Adds the POST /api/session-launches endpoint.
• Validates that bundleId and prompt are non-empty strings.
• Introduces a shared session provisioner used by both external launches and existing UI session creation.
• Installs the requested Agent Bundle and attaches its metadata.
• Seeds bundle triggers and persists the optional welcome message.
• Starts Prime, persists the external prompt, and dispatches it immediately.
• Rolls back the session, agent, triggers, database state, and workspace when provisioning fails.
• Returns only the session ID rather than exposing the internal Session object or workspace path.
• Documents the request contract and deployment requirements.

Authentication

Authentication remains an ingress responsibility rather than being implemented inside Express.

Quick should call this endpoint through a backend, shim, or Quick Core integration using the provisioned Basic Auth credential and Cloud-Auth header when required. Shared machine credentials should not be exposed to browser JavaScript.

Error responses

• 400 Bad Request — malformed request or invalid bundle.
• 404 Not Found — requested bundle is not installed.
• 500 Internal Server Error — unexpected provisioning failure.

Testing

• All 43 server tests pass.
• Server, shared, and web typechecks pass.
• Server and shared lint pass.
• Server build passes.
• Prettier and git diff --check pass.

Related to Shopify/oasis-frontend#688.

[Mbeaulne]

• Add API for externally launching Tangent sessions #74 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.