fix(admin): scope session timeline metrics by tenant

[skarL007]

Summary

• Scope /admin/subjects/{subject_id}/sessions/{session_id}/timeline episode_count to the same base query used for tenant-filtered episode rows.
• Scope per-episode citing_memory_count to tenant_id when the timeline request is tenant-filtered.
• Add an integration regression covering two tenants sharing the same subject/session ids, including a cross-tenant memory reference to prove the metric does not leak.

Test plan

• python -m ruff check server\api\admin.py tests\integration\test_admin_session_timeline_tenant_scope.py
• python -m ruff format --check server\api\admin.py tests\integration\test_admin_session_timeline_tenant_scope.py
• python -m py_compile server\api\admin.py tests\integration\test_admin_session_timeline_tenant_scope.py
• python -m pytest tests\test_tenant_scoping_invariant.py tests\test_route_limits_invariant.py tests\test_admin_dashboard.py -q
• STATEWAVE_EMBEDDING_PROVIDER=stub STATEWAVE_COMPILER_TYPE=heuristic PYTHONUTF8=1 python -m pytest tests -q --ignore=tests/integration --ignore=tests/smoke --ignore=tests/test_admin_subjects.py --ignore=tests/test_admin_clone.py --ignore=tests/test_memory_templates.py --ignore=tests/test_usage.py

Local integration note

• python -m pytest tests\integration\test_admin_session_timeline_tenant_scope.py -q was attempted, but this Windows environment has no running statewave_test Postgres on localhost:5432.
• docker compose up -d db was also attempted, but Docker Desktop's Linux daemon is not available on this machine.

[smaramwbc]

Exhaustively reviewed (correctness + security + test-quality, plus an adversarial verification pass that empirically tested pre/post against Postgres) — clean to merge.

• Correct & complete. episode_count now derives from the tenant-filtered base query instead of a tenant-ignoring subquery, and per-episode citing_memory_count adds if tenant_id: ...where(MemoryRow.tenant_id == tenant_id) — closing the cross-tenant metric leak on a shared subject/session id. No fan-out (episode/memory ids are global UUID PKs).
• Operator-global view preserved. Both new clauses are gated behind if tenant_id:, so the no-filter operator path is byte-identical pre/post (verified empirically). No over-scoping regression.
• Security pass clean. admin.py + integration test only; single authored commit; no exec/network/secret/obfuscation; no info leak. The third hunk is cosmetic ReceiptRow reformatting.

One non-blocking nit: the test asserts only the tenant-a filtered view — adding the operator-global and tenant-b assertions (as the #229 sibling test does) would guard against a future over-scoping regression. Happy to follow up. Thanks for another tight isolation fix.

— Statewave team