refactor: align Chat REST handlers with core Abilities API contract

[chubes4]

Summary

Remove all legacy fallback paths from Chat REST session handlers. REST is a thin wrapper around abilities — nothing else.

• Remove function_exists('wp_get_ability') guards (WP 6.9 minimum)
• Remove 3 direct-DB fallback code paths (list, get, delete)
• Introduce execute_ability() helper that follows core's WP_Ability::execute() contract
• Handle both WP_Error returns (from core) and legacy { success: false } arrays (from our callbacks)
• Every session handler is now a one-liner

Net: -61 lines (79 added, 140 removed)

Before

public static function delete_session( WP_REST_Request $request ) {
    $ability = function_exists( 'wp_get_ability' ) ? wp_get_ability( '...' ) : null;
    if ( $ability ) {
        $result = $ability->execute( ... );
        if ( empty( $result['success'] ) ) { return new WP_Error( ... ); }
        return rest_ensure_response( ... );
    }
    // Fallback: 20 lines of duplicated DB logic...
}

After

public static function delete_session( WP_REST_Request $request ) {
    return self::execute_ability(
        'datamachine/delete-chat-session',
        array(
            'session_id' => sanitize_text_field( $request->get_param( 'session_id' ) ),
            'user_id'    => get_current_user_id(),
        )
    );
}

Part of the broader ability contract alignment tracked in #999.