Add session acknowledgement API + dependency upgrades

[rockwellll]

Summary

• Acks API — Adds a new AcksAPI class (src/api/acks.js) that POSTs to public/acks with the current session and timestamp. The session setter now calls API.acks.send() on first set and whenever the session changes (identity change), using hello_session_ack_at as a guard to avoid duplicate acks. Business is now assigned first in Hellotext.initialize() so the ack has a valid auth context when fired during session initialization.

---

Note

Medium Risk
Adds a new network call triggered from the Session.session setter and changes cookie-based session side effects; incorrect conditions could cause extra requests or missed acknowledgements.

Overview
Adds a new AcksAPI (API.acks.send) that POSTs {session, at} to public/acks using Hellotext.headers.

Updates the Session.session setter to automatically send an ack on first set and whenever the session value changes, using a hello_session_ack_at cookie to suppress duplicate acks and resetting that cookie on identity changes. Test coverage is expanded in session_test.js to validate ack sending and cookie behavior.

^{Written by Cursor Bugbot for commit 1b2db51. This will update automatically on new commits. Configure here.}