fix(runtime): protect active ACP tasks from idle cleanup

[piorpua]

Summary

• Add a process-local active lease registry and authenticated, CSRF-protected conversation/team active lease endpoints.
• Expand ACP idle cleanup to reclaim stale warmup-only tasks while skipping conversations with active foreground leases.
• Add conversation runtime ensure, remove legacy warmup/config-options HTTP routes, and wait for team runtime rebuild kills before warmup.

Test Plan

• cargo fmt --all -- --check
• cargo clippy -p aionui-ai-agent -p aionui-conversation -p aionui-team -p aionui-app -- -D warnings
• cargo test -p aionui-ai-agent -p aionui-conversation -p aionui-team -p aionui-app
• cargo test --workspace
• just push -u origin aionissue/task-20260701-002-004

Reviewer Notes

• The active lease endpoints are state-changing routes with empty request bodies and must remain behind auth and CSRF protection.
• Lease state is process-local and has no database migration or persistence behavior.
• This backend change is intended to ship with the matching AionUi runtime ensure and foreground lease renewal changes.