feat(vibe): add durable versioned session API

backend/src/app.ts

@@ -15,8 +15,10 @@ import settingsRoutes from './routes/settings.routes.js';
 import graphRoutes from './routes/graph.routes.js';
 import { SessionDirector } from './services/session-director.service.js';
 import v2Routes from './routes/v2.routes.js';
+import vibeSessionsRoutes from './routes/vibe-sessions.routes.js';
 import discoveryRoutes from './routes/discovery.routes.js';
 import imagesRoutes from './routes/images.routes.js';
+import { VibeSessionCoordinator } from './services/vibe-session-coordinator.service.js';
 
 export interface AppConfig {
   port: number;
@@ -158,8 +160,18 @@ export async function buildApp(config: AppConfig) {
   fastify.register(graphRoutes, { prefix: '/api', dbService });
 
   const sessionDirector = new SessionDirector(dbService);
+  const vibeSessionCoordinator = new VibeSessionCoordinator(dbService, sessionDirector);
+  // Durable sessions intentionally do not trust x-user-id.  A self-hosted
+  // deployment may configure one owner through MUZICK_VIBE_USER_ID today;
+  // an authenticated deployment can replace this resolver at registration.
+  const vibeOwnerId = process.env.MUZICK_VIBE_USER_ID?.trim() || null;
 
   fastify.register(v2Routes, { prefix: '/api', dbService, sessionDirector });
+  fastify.register(vibeSessionsRoutes, {
+    prefix: '/api',
+    coordinator: vibeSessionCoordinator,
+    identityResolver: () => vibeOwnerId,
+  });
   fastify.register(discoveryRoutes, { prefix: '/api', dbService, jobService });
   // ponytail: /api/test/enqueue-job (manual job-enqueue test endpoint) removed —
   // nothing in the deployed app or its tests called it, and deployment never