feat: capture SSH exec commands (PLAN.md 4.4)

Bots often send commands via `ssh user@host <command>` (exec request)
rather than requesting an interactive shell. These were previously
rejected silently. Now exec commands are captured, stored on the session
record, and displayed in the web UI session detail page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/storage/store.go

@@ -27,6 +27,7 @@ type Session struct {
 	ConnectedAt    time.Time
 	DisconnectedAt *time.Time
 	HumanScore     *float64
+	ExecCommand    *string
 }
 
 // SessionLog represents a single log entry for a session.
@@ -76,6 +77,9 @@ type Store interface {
 	// UpdateHumanScore sets the human detection score for a session.
 	UpdateHumanScore(ctx context.Context, sessionID string, score float64) error
 
+	// SetExecCommand sets the exec command for a session.
+	SetExecCommand(ctx context.Context, sessionID string, command string) error
+
 	// AppendSessionLog adds a log entry to a session.
 	AppendSessionLog(ctx context.Context, sessionID, input, output string) error