fix(sidecar): POST /sessions response now matches GET shape (id+name+state+lastOutputAt)

Previously POST returned only { id, name }, while GET returns
{ id, name, state, lastOutputAt }. iOS clients that share a Decodable
for both endpoints (e.g. SessionItem in pi-remote-ios) failed to decode
the POST response with 'data couldn't be read because it is missing'.

The new session always starts in 'idle' state with empty lastOutputAt.
Documented the new shape in the route header comment.

extensions/remote-control/server/routes/sessions.ts

@@ -1,7 +1,7 @@
 /**
  * S-09 — multi-session CRUD routes.
  *
- * POST   /sessions              → { id, name }
+ * POST   /sessions              → { id, name, state, lastOutputAt }
  * GET    /sessions              → [{ id, name, description, state, lastOutputAt }]
  * PATCH  /sessions/:id          → updates @description
  * DELETE /sessions/:id          → kills tmux session, optionally clears buffer
@@ -110,7 +110,9 @@ async function handleCreate(
 
   try {
     const id = await spawnSession({ name });
-    sendJson(res, 201, { id, name });
+    // Include state + lastOutputAt to match the GET /sessions response shape
+    // so iOS clients can decode the response with the same type.
+    sendJson(res, 201, { id, name, state: "idle", lastOutputAt: "" });
   } catch (err) {
     sendJson(res, 500, { error: "internal_error", message: String(err) });
   }