Implement CE-WP-0005 T01-T08: demo app — sessions, uploads, ZIP archive

Turn the MVP into a self-contained demo. Users now:
  1. Land on an empty-state and create a named session.
  2. Drag-drop or pick arbitrary PDFs into that session.
  3. Annotate, build evidence, link to form fields — all session-scoped.
  4. Export the whole session as a single .zip archive (manifest +
     per-document PDFs).
  5. Import a .zip back — into a new session, or merged into an
     existing one (documents deduped by SHA-256 fingerprint;
     annotations/evidence/links added additively).

Architecture:
- New shared types: SessionId, Session, SessionArchiveManifest +
  parseSessionArchiveManifest with schema-version validation.
- SessionService (engine/services/sessions.ts) handles lifecycle
  (create/rename/delete/setActive) + emits 4 new events through its
  own bus; SharedContracts.md §4 lists the additions.
- SessionProvider (work/SessionContext.tsx) owns the cross-session
  state: service, per-session PdfByteStore registry, per-session
  version counter that drives EngineProvider remounts after imports.
- EngineProvider becomes session-aware (sessionId prop drives per-
  session localStorage keys). Bumping engineRevision after
  restoreFromStorage forces consumers to re-render so restored repos
  show up immediately.
- PdfByteStore (source/pdf/byte-store.ts) holds Uint8Array bytes per
  document and mints blob URLs; ingestPdfFromFile is the upload
  entry-point that wraps the existing ingestPdf pipeline.
- ADR-0008 locks the ZIP layout (manifest.json + documents/<id>.pdf),
  the manifest schema (schemaVersion 1), and the merge-on-collision
  policy. JSZip is the only new dependency.
- App.tsx restructured: SessionProvider at the root, EngineProvider
  keyed by ${sessionId}:${version}, hash routing #/s/<id>[/forms/demo],
  SessionMenu top-bar, CreateFirstSession empty state.
- New DocumentRemoved event for per-document delete cleanup in
  CollectionList; engine.documents.remove() is the new service method.

Tests:
- Unit: 16 SessionService lifecycle + persistence tests;
  per-session snapshot round-trip; PdfByteStore + ingestPdfFromFile;
  SessionArchive parser; exportSessionZip + importSessionZip with
  create + merge + corrupt-archive paths.
- DOM: UploadDropzone, session-scoped CollectionList delete,
  SessionMenu create/switch/rename, routing parser.
- E2E: tests/integration/session-export-reimport.dom.test.tsx walks
  the full create → annotate → export → reimport flow and asserts
  the additive merge (deduped doc + doubled evidence rows).
- Legacy E2Es updated to use a seed-session helper instead of the
  removed fixture-button flow.

Known limitation (documented in ADR-0008): re-importing your own
freshly-exported ZIP creates duplicate annotations. Forward pointer
left for an importBundleId follow-up.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/app/sessions/SessionMenu.dom.test.tsx

@@ -0,0 +1,132 @@
+// @vitest-environment happy-dom
+
+import { useEffect, useState } from "react";
+
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { SessionId } from "@shared/ids";
+import { SessionProvider, useSessionService } from "@work/index";
+
+import { SessionMenu } from "./SessionMenu";
+import { parseRoute } from "./routing";
+
+function HashSync() {
+  // Mirrors the production AppShell effect: hash changes drive
+  // SessionService.setActive so useActiveSession() resolves correctly.
+  const service = useSessionService();
+  const [tick, setTick] = useState(0);
+  useEffect(() => {
+    const onHash = () => setTick((t) => t + 1);
+    window.addEventListener("hashchange", onHash);
+    return () => window.removeEventListener("hashchange", onHash);
+  }, []);
+  useEffect(() => {
+    const route = parseRoute(window.location.hash);
+    if (route.sessionId && service.get(route.sessionId as SessionId)) {
+      service.setActive(route.sessionId as SessionId);
+    } else {
+      service.setActive(null);
+    }
+  }, [tick, service]);
+  return null;
+}
+
+function Wrap({ children }: { children: React.ReactNode }) {
+  return (
+    <SessionProvider>
+      <HashSync />
+      {children}
+    </SessionProvider>
+  );
+}
+
+function CurrentHash() {
+  return <span data-testid="current-hash">{window.location.hash || "(empty)"}</span>;
+}
+
+function SeedTwo() {
+  const service = useSessionService();
+  if (service.list().length === 0) {
+    service.create({ name: "Alpha" });
+    service.create({ name: "Beta" });
+  }
+  return null;
+}
+
+beforeEach(() => {
+  globalThis.localStorage?.clear();
+  history.replaceState(null, "", window.location.pathname);
+});
+
+afterEach(() => {
+  cleanup();
+  vi.restoreAllMocks();
+});
+
+describe("SessionMenu", () => {
+  it("creating a new session navigates the hash to /s/<id>", async () => {
+    render(
+      <Wrap>
+        <CurrentHash />
+        <SessionMenu />
+      </Wrap>,
+    );
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("session-menu-toggle"));
+    await user.click(screen.getByTestId("session-menu-new"));
+    await user.type(screen.getByTestId("session-new-input"), "Demo");
+    await user.click(screen.getByTestId("session-new-confirm"));
+    await waitFor(() => {
+      const route = parseRoute(window.location.hash);
+      expect(route.sessionId).toMatch(/^sess_/);
+      expect(route.mode).toBe("review");
+    });
+  });
+
+  it("switching sessions writes the chosen id into the hash", async () => {
+    render(
+      <Wrap>
+        <SeedTwo />
+        <CurrentHash />
+        <SessionMenu />
+      </Wrap>,
+    );
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("session-menu-toggle"));
+
+    const alphaBtn = await screen.findByText(/Alpha/);
+    await user.click(alphaBtn);
+    await waitFor(() => {
+      const route = parseRoute(window.location.hash);
+      expect(route.sessionId).not.toBeNull();
+      expect(route.mode).toBe("review");
+    });
+  });
+
+  it("rename rejects a duplicate name with an inline error", async () => {
+    render(
+      <Wrap>
+        <SeedTwo />
+        <SessionMenu />
+      </Wrap>,
+    );
+    const user = userEvent.setup();
+    // Switch to Alpha first so it becomes active and rename becomes available.
+    await user.click(screen.getByTestId("session-menu-toggle"));
+    const alphaBtn = await screen.findByText(/Alpha/);
+    await user.click(alphaBtn);
+
+    // Re-open menu (it closed after switch) and try rename → Beta (taken).
+    await user.click(screen.getByTestId("session-menu-toggle"));
+    await user.click(screen.getByTestId("session-menu-rename"));
+    const input = screen.getByTestId("session-rename-input") as HTMLInputElement;
+    // Clear existing value and type new
+    await user.clear(input);
+    await user.type(input, "Beta");
+    await user.click(screen.getByTestId("session-rename-confirm"));
+    const error = await screen.findByTestId("session-menu-error");
+    expect(error.textContent).toMatch(/already exists/);
+  });
+});