Validation note:

This PR fixes an API semantics bug in the session message loading workflow.

Before this change, a failure in the message read path was returned as HTTP 200 with an empty message list. That made two different states indistinguishable to API consumers:

• the session has no messages;
• the server failed to read the session messages.

This PR changes the failure path to return HTTP 500 with an error field, while preserving the existing response-shape fields (messages, total, hasMore, offset, limit) for compatibility.

Validation commands currently listed by this PR:

npm --workspace ui test
npm exec -- tsc --noEmit -p tsconfig.json

The API behavior change is correct, but the self-validation should be more focused. A route-level regression test should mock the message read function to throw and assert that:

• the response status is 500;
• the response includes error;
• the compatibility fields are still present.

That test would prove the fixed failure semantics directly.