feat: 'Show CLI sessions' toggle in Settings (#61)

Adds a server-side boolean setting (default: false) that controls whether
CLI sessions from state.db appear in the sidebar. Off by default so the
sidebar is clean until the user explicitly opts in.

- api/config.py: add show_cli_sessions to _SETTINGS_DEFAULTS and _SETTINGS_BOOL_KEYS
- api/routes.py: gate get_cli_sessions() call on the setting at request time
- static/index.html: checkbox in settings panel with description
- static/panels.js: load/save checkbox, refresh session list on save
- static/boot.js: load on startup alongside send_key and show_token_usage

Co-authored-by: Nathan Esquenazi <nesquena@gmail.com>

api/routes.py

@@ -188,10 +188,13 @@ def handle_get(handler, parsed):
 
     if parsed.path == '/api/sessions':
         webui_sessions = all_sessions()
-        cli = get_cli_sessions()
-        # Deduplicate: WebUI sessions always win if same session_id
-        webui_ids = {s['session_id'] for s in webui_sessions}
-        deduped_cli = [s for s in cli if s['session_id'] not in webui_ids]
+        settings = load_settings()
+        if settings.get('show_cli_sessions'):
+            cli = get_cli_sessions()
+            webui_ids = {s['session_id'] for s in webui_sessions}
+            deduped_cli = [s for s in cli if s['session_id'] not in webui_ids]
+        else:
+            deduped_cli = []
         merged = webui_sessions + deduped_cli
         merged.sort(key=lambda s: s.get('updated_at', 0) or 0, reverse=True)
         return j(handler, {'sessions': merged, 'cli_count': len(deduped_cli)})