A browser session is declared, never created by hand

[czpython]

A browser session exists because an extension declares it on its Extension
class. The stored row is a cache of what happened to that session — its
login state, its timestamps, its payload — not the session's identity. So
nothing creates a session by hand any more, and nothing materializes rows
ahead of time either.

Rows appear on the first action that needs one: a workflow borrowing the
login, an operator opening the login window, or a state import. Views only
read. Opening the sessions pane writes nothing to the database.

The pane now renders the declarations, joined with whatever rows exist. A
session that has been declared but never used shows up wanting a login,
which is how the operator learns an extension needs one — previously it was
invisible until something borrowed it, so the first login had nowhere to
start. A row whose declaring extension is gone still lists, marked as no
longer declared, with delete as its only action.

The wire is addressed by name, since the declared name (x_me.x) is the
identity; id leaves the response. Manual creation and rename are gone from
both the API and the UI — a renamed row would just orphan itself from its
declaration. State uploads now carry their payload format as a query param
and stamp it on the row, the way the borrow write-back already stamps it;
without that, a lazily created row would default to a profile directory
while the importer uploads storage-state JSON.

scripts/import_browser_session.py no longer creates anything. It refuses a
name no installed extension declares, and imports through the same lazy
door.