#3396 [Engine] Add opt-in Galahad session storage

本文

## Problem and result

Strata's existing slot API can persist its current conversation to a local file. Users who need encrypted, durable named sessions on supported NVIDIA systems have no integrated storage backend. With this opt-in change, the same API saves and restores complete Strata session images through Galahad; the existing file backend and default inference path stay unchanged.

## Related discussion

Previous closed submission: https://github.com/Niko1221/Strata/pull/1761. The maintainer asked for a rebase on current main, a title prefix and the current PR template. After updating the old submission, the `/reopen` check passed but GitHub refused to reopen it and instructed us to open a new pull request. This PR contains that rebased update.

## Approach

Add a separate Galahad adapter for full session images, configuration and CLI options, size/error handling, and user documentation. Galahad remains an optional import and requires a separately installed licensed package. Session operations remain explicit, limited to slot 0, and unavailable with parallel requests or the ordinary file backend. The rebase preserves the current session-save retry behavior. Galahad shutdown is guarded against duplicate close calls from normal shutdown and `atexit`.

## Validation

**Passed:**

- `.venv/bin/python -m unittest serve.test_galahad serve.test_slots serve.test_security` — 67 tests passed on Linux x86-64, Python 3.13, at revision `7e3494582faecba5934c1d43b692b98ecfe080e1`, based on main `5bda973a`.
- `.venv/bin/python serve/server.py --help` — Galahad options are present.
- `git diff origin/main --check` — no whitespace errors.

**Failed:**

- None observed.

**Not run:**

- Licensed native Galahad save/restart/restore, GPU output parity, and performance checks: this environment has no licensed NVIDIA setup.
- CUDA, HIP, and SYCL builds: no engine or backend kernel files changed.

## Limits

Requires Linux x86-64, a licensed NVIDIA GPU, and `galahad-kv==1.31.5`. Names are immutable, only slot 0 is supported, and the feature does not add automatic prefix caching. Mock tests establish the adapter and HTTP contract, not native persistence, encryption, GPU correctness, or performance.