feat: adopt Heddle hosted and remote run SDK

[roackb2]

Summary

• consume ConversationRunService from @roackb2/heddle/hosted
• expose SlideX runs through Heddle's canonical /remote event envelope
• validate and serialize every SSE event with the shared protocol codec
• add Last-Event-ID replay, disconnect cleanup, response backpressure, and transport error logging
• preserve the SlideX-owned application service for auth scope, session persistence, MotionDoc finalization, and product result projection
• project rich Heddle activities to the small JSON-safe public shape consumed by the editor

Root cause and impact

The previous server renamed Heddle events into a private envelope and hand-serialized JSON. Real dogfooding showed why the public projection matters: a passthrough schema leaked activity.state.trace[1].diagnostics, causing the strict remote codec to close the stream before the terminal result. The server now exposes only type, text, tool, and result.ok; internal engine state and traces remain private.

Dependency

Depends on Heddle #235 and temporarily pins immutable commit 1a8cb3b1fe563daf58416fc41fc9158182b11c58.

This PR must stay draft until Heddle is released and the pin is replaced with the exact npm version.

Validation

• clean npm ci
• 10 server tests, including canonical HTTP/SSE framing and Last-Event-ID replay
• npm run typecheck
• npm run build
• real Heddle/OAuth/MCP run: 12 ordered activities followed by result sequence 13
• replay from sequence 11 returned exactly activity 12 and result 13
• persisted validated MotionDoc contained the requested title and subtitle

No npm package was published.