feat(api): add minimal session events timeline pipeline

[naory]

Summary

• add a simplified append-only session_events model (id, session_id, event_type, created_at, metadata) with migration + indexes
• introduce typed session events and a single emitter helper, then mirror only the first 5 lifecycle events into timeline records
• expose timeline response as eventType / createdAt / metadata and standardize metadata shape for the first 5 events
• enforce post-write boundary emission ordering (decision event after decision persistence; settlement verified before close)
• add focused tests for emitter inserts, timeline ordering, boundary emissions, and event ordering

Test plan

• pnpm --filter api test -- test/events/emitSessionEvent.test.ts test/events/getSessionTimeline.test.ts test/routes/sessions.test.ts test/routes/gate.test.ts test/db/queries.session-events.test.ts
• pnpm --filter api test -- test/db/queries.session-events.test.ts test/routes/gate.test.ts test/stripeWebhook.test.ts test/services/paymentWatcher.matching.test.ts

Made with Cursor

[naory]

Contract change note for reviewers:

• /api/sessions/:sessionId/timeline response shape has changed from { event, timestamp } to { eventType, createdAt, metadata }.
• Updated docs in docs/LIFECYCLE_OBSERVABILITY_ANDTIMELINE_SPRINT.md to match this API contract.
• Timeline ordering is deterministic as ORDER BY created_at ASC, id ASC in both helper and DB query path.

I also verified there is currently no apps/driver consumer of this timeline endpoint.

[naory]

Follow-up refactor pushed:

• db.getSessionTimeline(...) now delegates to events/getSessionTimeline.ts.
• This keeps timeline SQL (ORDER BY created_at ASC, id ASC) and selected columns in one canonical query path.