fix(embed): isolate browser chat sessions

[RockChinQ]

Overview

Isolate embedded web-chat conversations by browser-tab session so visitors using the same pipeline cannot see or receive each other's messages.

• Generate a cryptographically random UUID v4 per embed tab and persist it in sessionStorage across refreshes.
• Send the session identifier with WebSocket, history, and reset requests, and validate it server-side.
• Scope person/group history, streaming indexes, resets, and live broadcasts by pipeline and client session.
• Use stable pipeline/session launcher IDs so reconnects and late replies retain the correct LangBot provider session.
• Preserve legacy dashboard/non-embed WebSocket behavior, including the dashboard group launcher.
• Prevent duplicate client session UUIDs on different pipelines from cross-routing replies.

Closes #2334

Screenshots

Not applicable; this is a WebSocket/session-isolation fix. Regression behavior is covered by unit and API integration tests.

Verification

• 106 passed — platform unit tests (excluding the unrelated existing DingTalk collection conflict)
• 17 passed — tests/integration/api/test_embed.py
• 30 passed — focused WebSocket isolation, attachment, and embed API suite
• Ruff lint and format checks passed
• node --check src/langbot/templates/embed/widget.js passed
• git diff --check passed
• Independent staged-diff review passed with no remaining blockers

Checklist

• I have read the contribution guide.
• I have signed or will sign the CLA when prompted.
• The related issue documents the requested behavior.
• I have tested the changes and confirmed the expected behavior.

[codecov]

Codecov Report

❌ Patch coverage is 65.78947% with 39 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../langbot/pkg/platform/sources/websocket_adapter.py	67.46%	27 Missing ⚠️
.../pkg/api/http/controller/groups/pipelines/embed.py	7.69%	12 Missing ⚠️

📢 Thoughts on this report? Let us know!