perf(sessions): omit provider signatures from browser payloads

[nannant666]

Opening a session currently sends provider continuation state with the browser transcript, including when thinking text and media are deferred. For OpenAI Responses, thinkingSignature can be a serialized reasoning item containing encrypted_content; that opaque payload can dominate the response although the browser only renders the thinking summary, answer, and tool input.

This change removes thinkingSignature, textSignature, and thoughtSignature from browser display copies. Persisted messages and SDK/model context keep their signatures so provider continuation and session restoration remain intact.

Implementation

• Reuse an immutable content/message projection for history and older context pages, full navigation trees, assistant SSE start/end events, and standalone tool calls in message_update.
• Route reconnect snapshots through the same SSE projection. Deduplication still compares the original SDK message reference.
• Preserve visible text/thinking, empty blocks, display flags, IDs, tool arguments, and nested user data containing similarly named keys. Unsigned messages keep their existing references.
• Keep raw HTML/JSONL exports intact: their embedded session entries are also used for restoration and continuation.

Reproduction

1. Open a saved session from an OpenAI Responses model that returned encrypted reasoning.
2. Request /api/sessions/<id>?deferThinking=1&deferMedia=1&tree=summary&force=1.
3. Inspect context.messages[*].content[*]: thinking text may be deferred while thinkingSignature still carries the complete provider reasoning item. Assistant SSE completions and reconnect snapshots can send the same state again.

After this change the browser payloads omit those block-level signatures. The original session entries remain suitable for provider replay.

Measured effect

The same two fixed private session snapshots were served before/after using isolated 0.11.1 builds with Pi 1.1.0 and the same request parameters above:

Snapshot	Original JSON	Projected JSON	Original gzip	Projected gzip	Gzip reduction
A	1,382,324 B	155,562 B	92,028 B	38,490 B	58.2%
B	755,210 B	256,752 B	442,501 B	61,292 B	86.1%

History, full-tree, and older-context responses all had zero provider signatures after projection. After removing only those fields from the original responses, all six response hashes matched the new responses; the snapshot file hashes also remained unchanged. These are payload reductions, not measurements of total browser opening time. No private transcripts or signature values are included in this PR.

Validation

• TypeScript tsc --noEmit and npm run lint: pass on the PR branch.
• 78 related tests pass, including frozen inputs, encrypted/empty reasoning, text and Gemini tool signatures, nested user data, pagination with/without thinking deferral, full/summary trees, SSE completion, reconnect deduplication, and cancellation. SSE backpressure tests also pass.
• Full suite: 2,634 pass, 1 skipped, 4 fail. The same four failures reproduce at the unmodified base 894e1a2: one read-only directory expectation under uid 0 and three worktree cases requiring Git --path-format, unavailable in this environment’s Git 2.30.2. No unrelated worktree or permission changes are included.
• The production-version backport builds successfully in an isolated release workspace. Dependency/native-module checks plus HTTP/session/model-list/terminal-input-output smoke checks pass.
• Offline replay through Pi’s OpenAI Responses adapter converted 1,718 preserved encrypted reasoning blocks back into request items while keeping frozen inputs and snapshot hashes intact. No model requests were sent.

All committed automated fixtures are synthetic.