feat(web): support Pi-native turn interrupt and cancellation

[sowen1023]

Parent

• [Roadmap] OpenPI Web：像 Codex / Kimi Code 一样的本地浏览器 Agent 工作台 #76

Problem

The current Web workbench can submit prompts and queue follow-up input, but it cannot stop an active model turn. The browser exposes only a Send action; WebRuntimeController has no interrupt/cancel operation, and the runtime only aborts sessions while disposing the whole Web host.

A long, stuck, or accidentally submitted turn therefore cannot be stopped without closing the workbench. Closing the host is not an acceptable per-turn control because it also tears down unrelated Web runtime state.

Value

• Let users recover immediately from a runaway or unwanted turn.
• Preserve the same cancellation lifecycle and terminal evidence as Pi instead of inventing a browser-only status.
• Establish the command/receipt boundary needed by future capability controls.

Approach constraints

• Reuse Pi AgentSession cancellation and lifecycle events as the source of truth.
• Bind every cancel request to the expected Web Session and current command/turn epoch.
• Define an exact receipt that distinguishes accepted, already settled, stale session, and failed cancellation.
• Do not infer cancellation from button state or optimistic UI.
• Keep queued follow-up prompt behavior explicit: cancellation must define whether queued input is retained or discarded.
• Preserve controller serialization, SSE resync, shutdown, and multi-client lease boundaries.

Acceptance criteria

• While a real provider turn is active, the composer exposes a Stop action.
• A valid Stop request cancels that turn through Pi native session lifecycle.
• A stale request cannot cancel a newer turn or a different Session.
• The UI reaches a canonical cancelled terminal state from runtime evidence.
• Repeated Stop requests are idempotent and return an explicit receipt.
• Behaviour for queued follow-up prompts is specified and covered by tests.
• Refresh/reconnect converges to the same state through snapshot + events.
• Host disposal remains separate from per-turn cancellation.
• Focused Web runtime/host/UI tests, bun run check, and bun run test pass.

Out of scope

• A global pause across every OpenPI capability; that broader problem is tracked in control: 研究 Pi-native 的全局安全暂停，让所有 Agent 在下一执行边界停住 #161.
• Controller handoff between TUI and Web.
• Adding a second cancellation state machine in the browser.