fix(server): create the default session atomically (no duplicate "Session #1")

[gwleclerc]

Problem

The e2e job flaked on main (the merge of #315): the "rename a session" test failed with

strict mode violation: getByText('Session #1', { exact: true }) resolved to 2 elements

i.e. two sessions named Session #1 existed at once.

Root cause

GetLastSession auto-creates a default session when the list is empty, but it released the lock between the empty-check and the creation, and NewSession computed the Session #N name outside the lock:

s.mu.Lock()
if len(s.sessions) == 0 {
    s.mu.Unlock()      // ← gap
    s.NewSession("")   // re-locks internally
    s.mu.Lock()
}

When the UI fires concurrent requests against an empty session list — the History page's parallel GET /sessions + /history + /mocks (+ autorefresh) right after Reset Sessions — two of them each see len == 0 and each create a Session #1. Intermittent → flaky. Violates PRINCIPLES.md §3.7 (concurrency safety).

Fix

Move the append into an unlocked newSessionLocked helper, called within a single critical section by both NewSession and GetLastSession (name + carried-over locked mocks are all derived from s.sessions, so they must be computed under the same lock). No behaviour change otherwise.

Test

TestGetLastSessionConcurrent fires 50 concurrent GetLastSession calls on an empty service and asserts exactly one session is created. Verified it fails on the old code (created 2 sessions, want 1) and passes on the fix; the whole suite is green under -race.

🤖 Generated with Claude Code