fix(session): normalize session directory filters across path variants

[jacky-2014-sn]

Issue for this PR

Closes #28038

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This normalizes session directory matching so Windows slash-equivalent paths are treated as the same location.

It updates the shared session list filtering path, keeps legacy rows without path matching correctly, and applies the same comparison rules to v2 session list filters and cursor validation.

How did you verify your code works?

• bun test --timeout 30000 test/server/session-list.test.ts
• bun typecheck

Screenshots / recordings

N/A

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential Duplicate PRs Found

PR #28027 - "fix(session): match Windows directory separators"

• Likely related to the same issue (closes fix(session): Windows session directory filters treat slash-equivalent paths as different #28038) and addresses Windows slash equivalency in session matching
• Appears to target similar path normalization concerns

PR #26580 - "fix: normalize Windows desktop session paths"

• Related to normalizing Windows session paths, though potentially addressing a different scope

PR #26463 - "fix: normalize Windows session directory filters"

• Directly related to session directory filter normalization on Windows

These PRs (#28027 in particular) appear to be addressing the same or closely related issues with Windows path separators in session handling. Recommend checking if #28027 is an earlier attempt at the same fix or if they address different aspects of the issue.

[jacky-2014-sn]

I took a closer look at the PRs the duplicate bot flagged.

There is definitely overlap with #28027 and #26463 in the shared session directory-matching logic, and #26580 is also related from the desktop/session path normalization side.

My understanding of the difference in scope is:

• #26463 and #28027 overlap heavily with the shared session filtering path
• #26580 is related, but also includes desktop-specific path-key / write-time normalization work
• this PR also covers the v2 session list path and the HTTP cursor validation path, so the same Windows slash-equivalence rules apply there as well
• this PR also keeps legacy session rows without path matching correctly through the directory fallback path
• local regression coverage was added in test/server/session-list.test.ts

So I agree this is part of the same bug cluster, but my intent with this PR was to make sure the fix is applied consistently across the shared session list path, the v2 path, and cursor validation, rather than only the shared filtering logic.

If you would prefer this work to be folded into one of the earlier PRs instead, I'm happy to rework this into a narrower follow-up or close it and move the extra coverage there.