Implement CE-WP-0005 T01-T08: demo app — sessions, uploads, ZIP archive

Turn the MVP into a self-contained demo. Users now:
  1. Land on an empty-state and create a named session.
  2. Drag-drop or pick arbitrary PDFs into that session.
  3. Annotate, build evidence, link to form fields — all session-scoped.
  4. Export the whole session as a single .zip archive (manifest +
     per-document PDFs).
  5. Import a .zip back — into a new session, or merged into an
     existing one (documents deduped by SHA-256 fingerprint;
     annotations/evidence/links added additively).

Architecture:
- New shared types: SessionId, Session, SessionArchiveManifest +
  parseSessionArchiveManifest with schema-version validation.
- SessionService (engine/services/sessions.ts) handles lifecycle
  (create/rename/delete/setActive) + emits 4 new events through its
  own bus; SharedContracts.md §4 lists the additions.
- SessionProvider (work/SessionContext.tsx) owns the cross-session
  state: service, per-session PdfByteStore registry, per-session
  version counter that drives EngineProvider remounts after imports.
- EngineProvider becomes session-aware (sessionId prop drives per-
  session localStorage keys). Bumping engineRevision after
  restoreFromStorage forces consumers to re-render so restored repos
  show up immediately.
- PdfByteStore (source/pdf/byte-store.ts) holds Uint8Array bytes per
  document and mints blob URLs; ingestPdfFromFile is the upload
  entry-point that wraps the existing ingestPdf pipeline.
- ADR-0008 locks the ZIP layout (manifest.json + documents/<id>.pdf),
  the manifest schema (schemaVersion 1), and the merge-on-collision
  policy. JSZip is the only new dependency.
- App.tsx restructured: SessionProvider at the root, EngineProvider
  keyed by ${sessionId}:${version}, hash routing #/s/<id>[/forms/demo],
  SessionMenu top-bar, CreateFirstSession empty state.
- New DocumentRemoved event for per-document delete cleanup in
  CollectionList; engine.documents.remove() is the new service method.

Tests:
- Unit: 16 SessionService lifecycle + persistence tests;
  per-session snapshot round-trip; PdfByteStore + ingestPdfFromFile;
  SessionArchive parser; exportSessionZip + importSessionZip with
  create + merge + corrupt-archive paths.
- DOM: UploadDropzone, session-scoped CollectionList delete,
  SessionMenu create/switch/rename, routing parser.
- E2E: tests/integration/session-export-reimport.dom.test.tsx walks
  the full create → annotate → export → reimport flow and asserts
  the additive merge (deduped doc + doubled evidence rows).
- Legacy E2Es updated to use a seed-session helper instead of the
  removed fixture-button flow.

Known limitation (documented in ADR-0008): re-importing your own
freshly-exported ZIP creates duplicate annotations. Forward pointer
left for an importBundleId follow-up.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/integration/helpers/seed-session.ts

@@ -0,0 +1,116 @@
+/**
+ * Test helper: pre-seed `localStorage` with an active session that holds
+ * one document + one representation, so an integration test can skip
+ * the empty-state + upload flow and mount straight into a populated
+ * Review/Forms layout.
+ *
+ * Pre-CE-WP-0005 integration tests clicked a "fixture button" in the
+ * `CollectionList` to load a sample PDF; after the session refactor
+ * there is no fixture list directly in the active-session UI. These
+ * legacy tests now call `seedSessionWithDoc` in `beforeEach` instead.
+ *
+ * The seed bypasses `SessionService.create()` (which mints a random
+ * id) so tests can reference the resulting `documentId` /
+ * `representationId` synchronously, before the app boots.
+ */
+
+import type { Document, DocumentRepresentation } from "@shared/document";
+import type { DocumentId, RepresentationId, SessionId } from "@shared/ids";
+import type { Session } from "@shared/session";
+
+export interface SeedOptions {
+  readonly sessionName?: string;
+  readonly documentTitle?: string;
+  readonly canonicalText: string;
+  readonly mode?: "review" | "forms";
+}
+
+export interface SeedResult {
+  readonly sessionId: SessionId;
+  readonly documentId: DocumentId;
+  readonly representationId: RepresentationId;
+}
+
+function rid(prefix: string): string {
+  return `${prefix}_seed_${Math.random().toString(36).slice(2, 10)}`;
+}
+
+export function seedSessionWithDoc(opts: SeedOptions): SeedResult {
+  const sessionId = rid("sess") as SessionId;
+  const documentId = rid("doc") as DocumentId;
+  const representationId = rid("rep") as RepresentationId;
+  const now = "2026-05-25T00:00:00.000Z";
+
+  const session: Session = {
+    id: sessionId,
+    name: opts.sessionName ?? "Test Session",
+    createdAt: now,
+    updatedAt: now,
+    lastOpenedAt: now,
+  };
+
+  const document: Document = {
+    id: documentId,
+    mediaType: "application/pdf",
+    ...(opts.documentTitle ? { title: opts.documentTitle } : {}),
+    fingerprint: "seed-fingerprint",
+    createdAt: now,
+    updatedAt: now,
+  };
+
+  const representation: DocumentRepresentation = {
+    id: representationId,
+    documentId,
+    representationType: "pdf-text",
+    contentHash: "seed-fingerprint",
+    canonicalText: opts.canonicalText,
+    pageMap: [{ page: 1, width: 595, height: 842 }],
+    offsetMap: [
+      {
+        page: 1,
+        globalStart: 0,
+        globalEnd: opts.canonicalText.length,
+        pageLength: opts.canonicalText.length,
+      },
+    ],
+    generatedAt: now,
+  };
+
+  const snapshot = {
+    version: 1,
+    documents: [document],
+    representations: [representation],
+    annotations: [],
+    evidenceItems: [],
+  };
+
+  const sessionsFile = {
+    version: 1,
+    sessions: [session],
+    activeSessionId: sessionId,
+  };
+
+  localStorage.setItem("citation-evidence:sessions:v1", JSON.stringify(sessionsFile));
+  localStorage.setItem("citation-evidence:active-session-id:v1", sessionId);
+  localStorage.setItem(
+    `citation-evidence:session:${sessionId}:engine-snapshot:v1`,
+    JSON.stringify(snapshot),
+  );
+  localStorage.setItem(
+    `citation-evidence:session:${sessionId}:active-document-id:v1`,
+    documentId,
+  );
+
+  // Set the hash so the App routes straight into the session.
+  const hash =
+    opts.mode === "forms"
+      ? `#/s/${sessionId}/forms/demo`
+      : `#/s/${sessionId}`;
+  history.replaceState(
+    null,
+    "",
+    window.location.pathname + window.location.search + hash,
+  );
+
+  return { sessionId, documentId, representationId };
+}