feat: attach client_session_id to requests and set the CLI session env var

[aqandrew]

What

Propagate the session ID from Phase 1 to outbound API requests and to the CLI,
so server-side logs, telemetry, and the spawned coder ssh process can all be
correlated with the extension's session.

This is Phase 2 of 3 for
DEVEX-661. It builds on
#1073.

Changes

• Requests (RFC req 3): add a sessionId argument to CoderApi.create and
  attach the session ID to every request via the W3C baggage header using the
  client_session_id key (baggage: client_session_id=<hex>), on both the REST
  default headers and the WebSocket handshake headers. Threaded through all
  CoderApi.create call sites, including the pre-auth OAuth/login/deployment
  clients, so every request carries it.
• Telemetry (RFC req 4.2): already satisfied — the shared ID is the
  telemetry sessionId, which ships on every event's context.
• CLI (RFC reqs 5.2/5.3): extend applySshEnvironment to also set
  CODER_TRACE_SESSION_ID on both process.env and the terminal environment
  collection, so the spawned coder ssh ProxyCommand reuses the plugin's
  session ID instead of generating its own.

Testing

• pnpm typecheck, targeted pnpm lint, full pnpm test:extension (2108
  passing).
• New tests: baggage: client_session_id=<hex> present/absent on CoderApi;
  CODER_TRACE_SESSION_ID applied to process.env and the terminal collection
  and restored on dispose.

---

🤖 Generated by Coder Agents.

[linear-code]

DEVEX-661