feat: jc 引擎主线搬入 app/engine（315 测试基线全绿：320 去掉 admin 5 用例）

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/test_chat_rest_session_history.py

@@ -0,0 +1,42 @@
+# `client` fixture from conftest (temp SQLite + overrides chat_rest.async_session).
+
+
+def test_session_creates_new(client):
+    r = client.post("/api/chat/session", json={})
+    assert r.status_code == 200
+    d = r.json()
+    assert "session_id" in d and d["is_new"] is True and d["ended"] is False
+
+
+def test_session_resume_active(client):
+    sid = client.post("/api/chat/session", json={}).json()["session_id"]
+    r = client.post("/api/chat/session", json={"session_id": sid})
+    assert r.json()["is_new"] is False
+
+
+def test_history_new_session_empty(client):
+    sid = client.post("/api/chat/session", json={}).json()["session_id"]
+    r = client.get(f"/api/chat/{sid}/messages")
+    assert r.status_code == 200 and r.json() == []
+
+
+def test_history_404_unknown_sid(client):
+    assert client.get("/api/chat/nope/messages").status_code == 404
+
+
+def test_history_rejects_non_app_session(client):
+    # widget-source conversations are not readable via this public endpoint
+    # (narrow the read surface to app only).
+    import asyncio
+    from app.engine.routes import chat_rest
+    from app.engine.services.conversation import ConversationManager
+    from app.engine.models import ConversationSource
+
+    async def _make_widget():
+        async with chat_rest.async_session() as db:
+            mgr = ConversationManager(db)
+            c = await mgr.create_conversation(source=ConversationSource.widget)
+            return c.session_id
+
+    sid = asyncio.run(_make_widget())
+    assert client.get(f"/api/chat/{sid}/messages").status_code == 404