feat(web): expose Pi thinking state

[seekskyworld]

Problem

Adds the reasoning-state inspection slice of #348. The Web workbench could not show the active Pi thinking level or model-supported levels.

Value

Users can inspect reasoning configuration from the browser while Pi remains authoritative.

Approach

Expose optional runtime getThinkingState() backed by Pi AgentSession and an authenticated GET /api/thinking endpoint. Existing controllers remain compatible; no credentials or configuration writes are introduced.

Validation

• npx tsc --noEmit
• git diff --check

Impact

• User-visible behavior: adds bounded reasoning-state inspection.
• Model-visible context/tools: none.
• Runtime/lifecycle: read-only Pi state projection.
• Persisted config/data: none.
• Compatibility/risk: additive optional seam; setting changes remain future work.

[tt-a1i]

Exact-head standards/spec review found no confirmed P2 or higher issue. The optional runtime seam delegates thinkingLevel and available thinking levels to the real Pi AgentSession API and exposes read-only inspection without changing configuration, tools or model context. Focused existing runtime/host tests passed 39/39; source inspection verified the locked Pi public methods. These existing tests are not dedicated new endpoint coverage or installed UI acceptance. Current PR CI is green, but main integration conflicts in host/types; recommend keeping this narrow capability after resolving conflicts and validating integration. No merge performed.

[tt-a1i]

Integrated into main through #444 (1919542). The Pi-owned thinking inspection getter and endpoint were retained with host/type conflict resolution and additional authentication/fallback coverage. Original contributor seekskyworld is credited as a co-author. Full local validation and Node 22/24/26, Web E2E and Windows CI passed. Closing this source PR as integrated; thank you for the contribution.