fix: correct route path, fix race condition, add persistence for active sessions

- Fix route path from /api/sessions/:id/move to /claude/api/claude/sessions/:id/move
- Fix race condition by fetching session once and storing isActiveSession flag
- Add database persistence for active session metadata changes
- Ensures consistency between in-memory and database state

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

server.js

@@ -634,13 +634,15 @@ app.delete('/claude/api/claude/sessions/:id', requireAuth, (req, res) => {
 });
 
 // Move session to different project
-app.post('/api/sessions/:id/move', requireAuth, (req, res) => {
+app.post('/claude/api/claude/sessions/:id/move', requireAuth, (req, res) => {
   try {
     const { id } = req.params;
     const { projectId } = req.body;
 
-    // Check if session exists (in-memory or historical)
+    // Check if session exists (in-memory or historical) - fetch once
     let session = claudeService.sessions.get(id);
+    let isActiveSession = !!session;
+
     if (!session) {
       // Check historical sessions
       const historicalSessions = claudeService.loadHistoricalSessions();
@@ -668,10 +670,13 @@ app.post('/api/sessions/:id/move', requireAuth, (req, res) => {
       }
 
       // Update session's metadata with projectId
-      if (claudeService.sessions.get(id)) {
+      if (isActiveSession) {
-        // Active session - update metadata
+        // Active session - update metadata and persist to database
-        const activeSession = claudeService.sessions.get(id);
+        session.metadata.projectId = validatedId;
-        activeSession.metadata.projectId = validatedId;
+        db.prepare(`
+          INSERT OR REPLACE INTO sessions (id, projectId, deletedAt)
+          VALUES (?, ?, NULL)
+        `).run(id, validatedId);
       } else {
         // Historical session - update in database
         db.prepare(`
@@ -681,10 +686,13 @@ app.post('/api/sessions/:id/move', requireAuth, (req, res) => {
       }
     } else {
       // Move to unassigned (projectId = null)
-      if (claudeService.sessions.get(id)) {
+      if (isActiveSession) {
-        // Active session - remove projectId from metadata
+        // Active session - remove projectId from metadata and persist to database
-        const activeSession = claudeService.sessions.get(id);
+        delete session.metadata.projectId;
-        delete activeSession.metadata.projectId;
+        db.prepare(`
+          INSERT OR REPLACE INTO sessions (id, projectId, deletedAt)
+          VALUES (?, NULL, NULL)
+        `).run(id);
       } else {
         // Historical session - update in database
         db.prepare(`