Move a session to another working directory

`POST /sessions/{id}/cwd`, behind a field in the session settings dialog. A
working directory is settled when the process is spawned -- the CLI is
launched with it as its cwd and there is no control request that changes one
-- so this records the new one and ends the process that is in the old one.
It does not start a replacement, and the field says so in a line beside it:
a session with no process starts on the next message or on Start, which is
this app's rule for that everywhere else, and "usually restarts" is a worse
control than "always stops".

The path is checked against the session's own machine and refused if it is
not there. The spawn path corrects instead of refusing, because it is
resuming a directory the *machine* recorded and that can be gone through
nobody's fault; a path somebody has just typed is different, and a mistyped
one accepted here would surface much later as a session that would not
start, with nothing pointing at the typo. The refusal names the machine and
the path, and is drawn under the field it is about.

Nothing of Claude Code's own is moved, and that is measured rather than
assumed: on CLI 2.1.237, `claude --resume <id>` finds a session from any
working directory -- an id that does not exist answers "No conversation
found with session ID", and a real one resumed from an unrelated directory
did not. So the conversation continues in the new place with nothing
relocated. Doing otherwise would mean reproducing a rule this app cannot
see the whole of; PLAN.md records what that rule is, for whoever tries.

Found while checking it: `SessionInfo.cwd` came from the snapshot a session
launched with, so a moved session went on reporting its *old* directory for
as long as its process lived -- a dialog showing a directory the next launch
would not use, with nothing saying so. It is read from the config where the
row is built now, the same way `setup_name` already was, and for the reason
already written above `setup_name`: only the manager holds the config, and
both of these change under a running session.

Checked end to end on the emulator against a session whose process really
does take a cwd: /proc said /tmp/cwd-a before and /tmp/cwd-b after, the
dialog showed the new path immediately rather than after a restart, and a
directory that is not there and a relative path were both refused with the
session left exactly as it was.

server/src/routes.rs

@@ -24,6 +24,8 @@
 //! POST   /sessions/{id}/stop           end the process; the session and transcript stay
 //! POST   /sessions/{id}/start          run the process again, continuing the conversation
 //! POST   /sessions/{id}/title          {title}
+//! POST   /sessions/{id}/cwd            {cwd} -- move it; stops the process,
+//!                                     which starts again in the new one
 //! POST   /sessions/{id}/model          {model}
 //! POST   /sessions/{id}/command        {text}  -- /compact, /clear, /rename x, or the dialect's own
 //!                                     (starts the process first if it has exited)
@@ -101,6 +103,7 @@ pub fn router(manager: Arc<SessionManager>) -> Router {
         .route("/sessions/{id}/stop", post(stop))
         .route("/sessions/{id}/start", post(start))
         .route("/sessions/{id}/title", post(rename))
+        .route("/sessions/{id}/cwd", post(set_cwd))
         .route("/sessions/{id}/model", post(set_model))
         .route("/sessions/{id}/permission-mode", post(set_permission_mode))
         .route("/sessions/{id}/notify", post(set_notify))
@@ -1054,6 +1057,68 @@ async fn rename(
     Ok(StatusCode::NO_CONTENT)
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+struct CwdRequest {
+    cwd: PathBuf,
+}
+
+/// Moves a session to a different working directory.
+///
+/// The directory is checked here rather than in the manager because
+/// checking it is an ssh round trip on a remote setup, and the manager is
+/// not async -- the same division `POST /sessions` already makes for the
+/// directory an import was recorded in.
+///
+/// Checked rather than trusted, and refused rather than corrected: a
+/// mistyped path that was accepted would leave a session recorded somewhere
+/// its process cannot start, and the failure would arrive later, as a
+/// session that would not come back, with nothing pointing at the typo. The
+/// spawn path corrects instead because it is resuming a directory the
+/// *machine* recorded, which can be gone through nobody's fault; a path
+/// somebody has just typed is different.
+///
+/// Note what this does not do: it does not start a replacement process.
+/// See [`SessionManager::set_session_cwd`].
+async fn set_cwd(
+    State(manager): State<Arc<SessionManager>>,
+    UrlPath(id): UrlPath<String>,
+    axum::Json(body): axum::Json<CwdRequest>,
+) -> Result<StatusCode, ApiError> {
+    let session = manager
+        .sessions()
+        .into_iter()
+        .find(|session| session.id == id)
+        .ok_or_else(|| ApiError::NotFound(format!("no session {id}")))?;
+    let cwd = body.cwd.to_string_lossy().trim().to_string();
+    if cwd.is_empty() {
+        return Err(ApiError::BadRequest(
+            "a working directory is a path, and this one is empty".to_string(),
+        ));
+    }
+    // Absolute, because the alternative is relative to whatever the CLI is
+    // launched from, which is not something the person typing it can see.
+    if !cwd.starts_with('/') && !cwd.starts_with('~') {
+        return Err(ApiError::BadRequest(format!(
+            "{cwd} is not an absolute path, so where it would be depends on where the \
+             session happens to start"
+        )));
+    }
+    let setup = setup_by_id(&manager, &session.setup)?;
+    let transport = crate::session::transport::Transport::for_setup(&setup);
+    if !crate::session::import::directory_exists(&transport, &cwd).await {
+        return Err(ApiError::BadRequest(format!(
+            "{} has no directory {cwd}",
+            setup.name
+        )));
+    }
+    manager
+        .set_session_cwd(&id, PathBuf::from(&cwd))
+        .map_err(bad_request)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
 struct ModelRequest {