feat(fbrain): daemon completes viewer-session wraps; viewer-session list/revoke

[futurepaul]

Stack: #576 → #577 → #578 → #579. Builds on the 2a server routes.

Phase 2b of the brain:// live viewer plan. The agent (key-holding
client) completes pending viewer-session wraps opportunistically on
sync, mirroring the grant-wrap contract:

• sync reads pendingViewerWraps from the export (admin-gated field
  from 2a) and NIP-44 wraps the current Folder Key to each waiting
  ephemeral npub (finite-nostr nip44), posting to the
  viewer-session-wraps route. v1 auto-approve rule: only wraps the
  Brain owner requested complete; stranger-requested and org-brain
  wraps stay pending for the later approval-card generalization.
  Never blocks sync; skipped quietly when the Folder Key is not
  openable here.
• sync now --summary reports 'viewer sessions:' rows.
• new fbrain viewer-session list/revoke surfaces the key-delivery
  records with status and expiry (revocation = key hygiene only).

Tests:

• unit: the wire payload is real NIP-44 ciphertext the ephemeral key
  decrypts into exactly the Folder Key; non-owner and org-brain wraps
  never POST; the raw key never persists to disk.
• process acceptance (Direction-3, real server, live clock): fixture
  ephemeral key requests via the owner identity, owner sync completes
  the wrap, the ephemeral key unwraps the Folder Key, the
  encrypted-read returns ciphertext that decrypts to the known
  plaintext, the /brain-updates SSE notification is observed after a
  CLI edit in another terminal, delta fetch picks up the edit, a 1s
  TTL lapses to an honest 403 'viewer session expired', and CLI
  revocation yields 403 'viewer session revoked'.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}