fix(control-ui): preserve URL session parameter over localStorage defaults

When opening the dashboard with a ?session= URL parameter, the session
was being overwritten by applySessionDefaults() after the gateway
connected. This broke direct links to specific sessions (e.g., from
external tools like Kanban boards with per-project sessions).

The fix adds a sessionFromUrl flag that's set when a session is
explicitly provided via URL. applySessionDefaults() now checks for
this flag and skips overriding URL-provided sessions.

Fixes #4150

ui/src/ui/app-gateway.ts

@@ -84,6 +84,16 @@ function normalizeSessionKeyForDefaults(
 
 function applySessionDefaults(host: GatewayHost, defaults?: SessionDefaultsSnapshot) {
   if (!defaults?.mainSessionKey) return;
+  
+  // If session was explicitly set from URL, don't override with defaults
+  // This ensures direct links to specific sessions work correctly
+  const hostWithFlag = host as GatewayHost & { sessionFromUrl?: boolean };
+  if (hostWithFlag.sessionFromUrl) {
+    // Clear the flag after first connection so future reconnects can apply defaults if needed
+    hostWithFlag.sessionFromUrl = false;
+    return;
+  }
+  
   const resolvedSessionKey = normalizeSessionKeyForDefaults(host.sessionKey, defaults);
   const resolvedSettingsSessionKey = normalizeSessionKeyForDefaults(
     host.settings.sessionKey,

ui/src/ui/app-settings.ts

@@ -88,6 +88,8 @@ export function applySettingsFromUrl(host: SettingsHost) {
     const session = sessionRaw.trim();
     if (session) {
       host.sessionKey = session;
+      // Mark that this session was explicitly set from URL to prevent override by defaults
+      (host as { sessionFromUrl?: boolean }).sessionFromUrl = true;
       applySettings(host, {
         ...host.settings,
         sessionKey: session,