Bound Web model context without truncating transcripts

[oratis]

Summary

• cap the Web provider history view at 64k estimated tokens by default (LISA_WEB_CONTEXT_TOKENS is bounded/configurable)
• reserve that budget for the current text and attachments before selecting historical messages
• keep the canonical TenantRuntime history and append-only SessionStore transcript complete
• avoid provider-invalid context boundaries by excluding orphan leading tool_result and trailing tool_use fragments
• inject the latest durable reflection summary when older messages are omitted, marked and sanitized as historical data rather than instructions
• tell the model that omitted detail remains recoverable through memory_search
• load reflection summaries per tenant and refresh them after manual/background reflection

Dependency

Stacked on #319 (which follows #318 and #317). Merge in stack order and retarget successors to main.

Validation

• npm run typecheck
• focused context/session/agent tests — 23 passed
• npm test — 1461 passed, 1 skipped, 0 failed
• npm run build