Phase 2 scaffold: mitra online status & pairing logic

Add mitra online/offline status with heartbeat-based auto-offline,
customer-mitra pairing via Valkey pub/sub blast, session management,
and control center dashboard with real-time stats.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/src/routes/internal/session.routes.js

@@ -0,0 +1,48 @@
+import { authenticate, requirePermission } from '../../plugins/auth.js'
+import { getCcUserByFirebaseUid } from '../../services/cc-user.service.js'
+import { listSessions, getSessionById, rerouteSession } from '../../services/session.service.js'
+import { getDashboardStats } from '../../services/dashboard.service.js'
+
+const attachCcUser = async (request, reply) => {
+  const user = await getCcUserByFirebaseUid(request.firebaseUser.uid)
+  if (!user) return reply.code(403).send({ success: false, error: { code: 'FORBIDDEN', message: 'Not a control center user' } })
+  request.ccUser = user
+}
+
+export const sessionManagementRoutes = async (app) => {
+  app.get('/dashboard/stats', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (request, reply) => {
+    const stats = await getDashboardStats()
+    return reply.send({ success: true, data: stats })
+  })
+
+  app.get('/', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (request, reply) => {
+    const { page = 1, limit = 20, status } = request.query
+    const result = await listSessions({ page: Number(page), limit: Number(limit), status })
+    return reply.send({ success: true, data: result })
+  })
+
+  app.get('/:sessionId', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'read')],
+  }, async (request, reply) => {
+    const session = await getSessionById(request.params.sessionId)
+    if (!session) {
+      return reply.code(404).send({ success: false, error: { code: 'NOT_FOUND', message: 'Session not found' } })
+    }
+    return reply.send({ success: true, data: session })
+  })
+
+  app.post('/:sessionId/reroute', {
+    preHandler: [authenticate, attachCcUser, requirePermission('config', 'update')],
+  }, async (request, reply) => {
+    const { new_mitra_id } = request.body ?? {}
+    if (!new_mitra_id) {
+      return reply.code(422).send({ success: false, error: { code: 'VALIDATION_ERROR', message: 'new_mitra_id is required' } })
+    }
+    const session = await rerouteSession(request.params.sessionId, new_mitra_id)
+    return reply.send({ success: true, data: session })
+  })
+}