feat(routes): PATCH /v1/sessions/{id} for partial cost_data update

[rdwj]

Summary

Lands the platform half of the cost-tracking round-trip from #2: a PATCH /v1/sessions/{session_id} route that delegates to SessionStore.update() for a shallow merge of cost_data (write-wins per top-level key). 404 if the session does not exist — no auto-create on PATCH, matching the wire contract in the issue.

The handler is a thin veneer; persistence and merge semantics live in fipsagents.server.sessions.SqliteSessionStore / PostgresSessionStore, consistent with the rest of this service.

Wire contract

PATCH /v1/sessions/{session_id}
Content-Type: application/json
Authorization: Bearer <jwt>

{ "cost_data": { "input_tokens": 1234, "output_tokens": 567, ... } }

• 200 with {"session_id", "messages": [...]} on success
• 404 if the session does not exist
• cost_data: null is a no-op merge but still confirms existence (200/404 same as a populated body)
• Auth: same require_user dependency as the sibling sessions endpoints

Companion

• fips-agents/agent-template#116 already ships the agent-side HttpSessionStore.update() that speaks this wire shape; its e2e tests pass against this endpoint.

Test plan

• pytest -q — 43 passed (5 new in test_sessions.py)
• make lint
• gitleaks protect --staged --no-banner --redact — no leaks
• Two-call merge with overlapping keys ({a:1} then {b:2,a:5} -> {a:5,b:2})
• PATCH on missing session returns 404
• PATCH with cost_data: null is a no-op on existing accumulator state
• PATCH with cost_data: null on missing session still 404
• PATCH echoes persisted message history alongside the merge

Closes #2

Assisted-by: Claude Code (Opus 4.7)