refactor(FEAT-025): route /export through the session-export facet

TUI side of the slice. `SessionExportAdapter` becomes the sole owner of concrete
export machinery - metadata derivation, authoritative/visible-history
projection, semantic restore-point projection, the shared `turn_handoff_markdown`
renderer, clipboard mode/recovery/delivery, and protected destination
resolution/writing - and the envelope exposes it only when `SESSION_EXPORT` is
declared. Hidden reasoning bodies, signatures, and inline/local image payloads
are dropped while the projection is built (D9).

Host services that must outlive the physical move live in
`commands/session_export_host.rs`, outside `groups/session`: the shared
`last-copy.md` recovery writer now reused by `/copy`, and the protected
export-destination resolver/writer. Their algorithms, check order, error text,
and platform behaviour are the baseline implementations relocated unchanged.

The portable handler owns parsing, document rendering, redaction, restore-point
correlation, operation sequencing and every user-visible string. It renders from
an owned projection and redacts JSON in place, so no payload is copied twice.
`/structcopy` only rewires its sanitizer import and stays legacy; its stale
"export seam" prose is corrected.

`/export` keeps its declared order, name, alias, usage, and discovery surface.

Generated with CodeWhale

Author: Paulo Aboim Pinto