Scope session config changes to their session; mjconfig owns defaults

[foundev]

Summary

Session settings now follow one rule: a change made anywhere in mj applies only to the session it was made in, and only /mjconfig also changes the defaults new sessions start from.

• Live changes are session-local. /model, /effort, and session-option changes are no longer written back to config.toml: persist_accepted_session_config and the session_config[].models routes layer are deleted, so live tweaks can't leak into new sessions or subagents. Leftover [session_config.*.models] tables in old configs still parse and are ignored.
• Plain save. save_user_config_preserving_session_routes becomes a plain locked save_user_config — with no live write-back there is nothing to merge.
• Web mjconfig is scoped to the invoking session. The save carries the viewer's session_id; the server reloads that one session's auxiliary routes instead of broadcasting ReloadAuxiliaryAgents to every running session.
• Combined saves apply fully. A save that replaces the primary still updates the invoking session's reviewer and subagent lanes: both runtime handlers (TUI and server) re-pair auto seats against the still-running primary via the new rebind_auto_subagents_for_primary instead of bailing, and the TUI always sends the aux reload while the primary-route check gates only the switch-primary prompt.
• Defaults reach every new start. Server clear/new re-reads saved defaults from disk via the new SavedSessionConfigReload source, so an /mjconfig save made after launch reaches fresh sessions on the same runtime.

Docs (configuration.md) updated to state the contract.

Test plan

• cargo test --workspace — green (~2,000+ tests), including new coverage:
  • accepted_live_config_update_is_never_persisted
  • stale_model_route_tables_are_ignored
  • fresh_session_reloads_saved_defaults_from_disk
  • combined-save (team change + session option) applies both aux reload and live option update
  • scoped server reload does not reach other sessions
  • rebind_auto_subagents_for_primary rebind + explicit-pin-kept cases
• cargo clippy --all-targets — clean

🤖 Generated with Claude Code