test: strengthen Cypress e2e tests with real API assertions

- Remove blanket uncaught:exception suppressor (API-only tests)
- Trim smoke test to single infra-verification assertion
- Rewrite health test with strict status/field assertions, no failOnStatusCode
- Add session CRUD tests (create, get, list, delete, 404 cases, cleanup)
- Use Cypress.env('API_URL') instead of baseUrl to avoid blocking smoke tests
- Remove unused main and type fields from package.json

cypress/support/e2e.js

@@ -1,5 +1,6 @@
 // Cypress E2E support file
-// Add custom commands and global hooks here
 
-// Prevent Cypress from failing on uncaught exceptions from the app
-Cypress.on('uncaught:exception', () => false);
+// Base URL for API tests. Override with CYPRESS_API_URL env var.
+// Not set as Cypress baseUrl to avoid server-reachability checks
+// that would block offline tests (smoke).
+Cypress.env('API_URL', Cypress.env('API_URL') || 'http://localhost');