feat(api): centralize session event log bridge

[naory]

Summary

• add a single emitSessionEvent() helper in the DB layer and route session timeline writes through it instead of scattered insert SQL
• enforce minimal timeline scope for now by ingesting only five core lifecycle milestones: SESSION_CREATED, POLICY_GRANT_ISSUED, PAYMENT_DECISION_CREATED, SETTLEMENT_VERIFIED, SESSION_CLOSED
• add a session timeline index migration for ordered /api/sessions/:id/timeline queries (session_id, created_at)

Test plan

• pnpm --filter api test -- test/routes/sessions.test.ts test/routes/gate.test.ts test/stripeWebhook.test.ts

Made with Cursor

[naory]

Updated this PR with correlation-id enrichment for mirrored session_events metadata.

Included identifiers (when available):

• decisionId
• policyHash
• txHash
• rail
• asset
• vehicleId
• lotId

Also added focused tests in apps/api/test/db/queries.session-events.test.ts to lock in:

• enrichment from inferred settlement/payload fields
• precedence of payload-provided values over inferred values

Validation:

• pnpm --filter api test -- test/db/queries.session-events.test.ts test/routes/sessions.test.ts
• pnpm --filter api test -- test/routes/sessions.test.ts test/routes/gate.test.ts test/stripeWebhook.test.ts