[Enhancement]: HTTP fleet API — RFC for remote session lifecycle

[rosspeili]

Area (optional)

general

Problem or use case

Roadmap: headless open/status/export/approve for fleet workers. Today SDK + CLI only.

Proposed behavior

RFC: minimal ASGI/REST, auth hook, read-only export endpoint MVP. Threat model in SECURITY.md. No model routing.

Alternatives considered (optional)

SSH-wrapped CLI only — insufficient for fleet scale.