fix: wire plan-gate activation and add express.json to steer/plan-gate routes

- Wire planGateRuntime.activate() into session creation path when planGate is true
  (Bug 1: sessions map stayed empty, plan/status always returned none)
- Add express.json({ limit: '1mb' }) to session-steer and plan-gate POST routes
  (Bug 2: req.body was undefined, POST with JSON body returned 400)
- Pass planGateRuntime dependency to createOpenChamberSessionService
- Add route-level and integration tests for both fixes

packages/web/server/lib/plan-gate/runtime.js

@@ -7,6 +7,7 @@
 // runtime detects the plan in the first assistant message, emits plan-ready,
 // and holds until approve/reject/timeout.
 
+import express from 'express';
 import { GOAL_OBJECTIVE_CHAR_LIMIT } from '../session-goal/objectives.js';
 
 const asRecord = (value) => (value && typeof value === 'object' && !Array.isArray(value) ? value : null);
@@ -300,7 +301,7 @@ export function registerPlanGateRoutes(app, runtime) {
     res.status(status).json({ error: error?.message ?? fallback });
   };
 
-  app.post('/api/openchamber/session/:sessionID/plan/approve', async (req, res) => {
+  app.post('/api/openchamber/session/:sessionID/plan/approve', express.json({ limit: '1mb' }), async (req, res) => {
     try {
       const sessionId = asNonEmptyString(req.params?.sessionID);
       if (!sessionId) return res.status(400).json({ error: 'sessionID is required' });
@@ -313,7 +314,7 @@ export function registerPlanGateRoutes(app, runtime) {
     }
   });
 
-  app.post('/api/openchamber/session/:sessionID/plan/reject', async (req, res) => {
+  app.post('/api/openchamber/session/:sessionID/plan/reject', express.json({ limit: '1mb' }), async (req, res) => {
     try {
       const sessionId = asNonEmptyString(req.params?.sessionID);
       const feedback = asNonEmptyString(req.body?.feedback);