feat(web-client): support typed server requests and plan-mode turns

[SeleiXi]

Summary

This PR upgrades the web client to better match newer Codex turn semantics and request handling.

It includes:

• forwarding reasoning effort in web turn payloads
• adding one-shot plan mode turns, with downgrade fallback when the runtime does not support collaboration mode
• supporting typed server requests and structured prompt cards in the web UI
• adding protocol regression coverage for the new request/turn flows
• tightening empty-rollout handling when reading thread history

Included commits

• 99ff5ca fix(web): forward reasoning effort in turn payloads
• efabf72 feat(web): add one-shot plan mode turns with downgrade fallback
• 969ece5 feat(web): support typed server requests and structured prompt cards
• e20cb1e test(web): add protocol regression coverage
• 7ec4407 fix(server): enhance error handling for empty rollouts in thread processing

Why

The web client was lagging behind newer turn/start and server-request behavior.
This PR closes that gap so the web experience can:

• send reasoning level correctly
• arm and submit plan-mode turns from the browser
• render and track typed server-side requests more reliably
• recover more safely when thread history temporarily returns incomplete rollout data

Implementation details

Turn payload updates

• include reasoning effort in turn payload construction
• add one-shot plan mode support in the web composer flow
• retry without collaboration mode when the runtime rejects that field

Typed request support

• track typed server requests in the browser state
• render structured prompt/request cards in the conversation UI
• encode/decode the newer request/response payload shapes on the server side

Thread read resiliency

• improve thread/read fallback behavior for transient empty rollout cases
• preserve UI continuity instead of surfacing hard failures for recoverable protocol gaps

Tests

• add regression coverage for:
  • turn/start payload construction
  • collaboration-mode downgrade retry
  • typed request tracking and response encoding
  • thread/read fallback on empty rollout responses

Verification

• npm test in web-client
• verified browser behavior against the updated turn/request protocol