feat: v2.5.4 — Query Explorer folded into Sessions, Windows picker and paths

- Sessions page tabs: Sessions · Events · Agents. QueryExplorer.tsx became
  AgentsTable.tsx (agents only — sessions and events already had tabs);
  /query redirects to /sessions?view=agents and leaves the sidebar.
  GET /api/query is unchanged and still answers all three entities.
- Windows picker opens in front: -EncodedCommand script spends the hidden
  first ShowWindow that windowsHide gives the process, then brings the TopMost
  owner forward via AttachThreadInput (v2.5.3's owner was itself hidden).
- Session page Resume/Fork/Open pane: owningLane and sessionWorktreeName
  match Windows folders (either separator), with a test.

server/README.md

@@ -463,7 +463,7 @@ The OpenAPI spec is generated from `server/openapi.js` (`createOpenApiSpec()`),
 | `POST`  | `/api/snapshots`    | `{session_id, redact?: {file_paths?}}` → freeze the session into an immutable row under a random token (same-origin) |
 | `GET`   | `/api/snapshots/:token` | `{snapshot, payload}` — the frozen session, agents, events, stats and cost |
 | `DELETE`| `/api/snapshots/:id` | Delete a snapshot (same-origin) |
-| `GET`   | `/api/query`        | Query Explorer: sessions / events / agents filtered, sorted from an allowlist, paged; `format=csv\|json` exports the whole filter (≤ 50,000 rows) — `server/routes/query.js` |
+| `GET`   | `/api/query`        | Query Explorer (the Sessions page's Agents tab): sessions / events / agents filtered, sorted from an allowlist, paged; `format=csv\|json` exports the whole filter (≤ 50,000 rows) — `server/routes/query.js` |
 | `GET`   | `/api/reports`      | Scheduled report definitions with their latest run (`server/lib/reports.js`) |
 | `POST`/`PUT`/`DELETE` | `/api/reports[/:id]` | Create / update / delete a report definition (same-origin; delete also removes its runs and files) |
 | `POST`  | `/api/reports/:id/run` | Run a report now (same-origin) |