fix(notifications): suppress permission notifs when session auto-accepts

Server now mirrors client-side Permission Auto-Accept via
POST /api/notifications/auto-accept and short-circuits permission.asked
dispatch (walking the session parent chain). Prior 500ms debounce raced
the client auto-response and leaked notifications.

Also hint under Summarize Last Message that templates must contain
{last_message} for the setting to take effect.

packages/web/server/lib/opencode/bootstrap-runtime.js

@@ -47,6 +47,7 @@ export const createBootstrapRuntime = (dependencies) => {
       modelsMetadataCacheTtl,
       fetchFreeZenModels,
       getCachedZenModels,
+      setAutoAcceptSession,
     } = options;
 
     registerServerStatusRoutes(app, {
@@ -100,6 +101,7 @@ export const createBootstrapRuntime = (dependencies) => {
       markSessionUnviewed: sessionRuntime.markSessionUnviewed,
       markUserMessageSent: sessionRuntime.markUserMessageSent,
       setPushInitialized,
+      setAutoAcceptSession,
     });
 
     registerOpenChamberRoutes(app, {