fix(sessions): use entities query for list — hybridSearch requires project arg

hybridSearch mandates a project scope, but sessions scatter across
per-session projects (session-<uuid>). The entities query accepts
optional project — omit it to list SESSION entities across all projects.

Also adds projectId to the list response so callers can scope follow-up
queries to the right session project.

Fixes: GET X-Service:sessions X-Resource:sessions returning 502

internal/sessions/handler_test.go

@@ -18,7 +18,8 @@ import (
 // "query" field and records captured request bodies.
 //
 //   - "upsertEntity" → mutation response
-//   - "hybridSearch"  → search response
+//   - "hybridSearch"  → search response (get, patch, episodes handlers)
+//   - "entities"      → list response (sessions list handler)
 //   - "entity"        → single entity response
 func newGQLServer(t *testing.T, captured *[]byte) *httptest.Server {
 	t.Helper()
@@ -33,7 +34,11 @@ func newGQLServer(t *testing.T, captured *[]byte) *httptest.Server {
 		case strings.Contains(bs, "upsertEntity"):
 			fmt.Fprint(w, `{"data":{"upsertEntity":{"id":"test-entity-id","created":true}}}`)
 		case strings.Contains(bs, "hybridSearch"):
+			// get, patch, episodes handlers still use hybridSearch
 			fmt.Fprint(w, `{"data":{"hybridSearch":{"entities":[]}}}`)
+		case strings.Contains(bs, "entities"):
+			// sessions list handler uses entities query
+			fmt.Fprint(w, `{"data":{"entities":{"entities":[]}}}`)
 		case strings.Contains(bs, "entity"):
 			fmt.Fprint(w, `{"data":{"entity":null}}`)
 		default: