raw-events: accept per-event session IDs when top-level id is msg_*

[kunickiaj]

Problem

POST /api/raw-events rejects the whole batch if the top-level opencode_session_id starts with msg_, even when every event in events[] includes a valid opencode_session_id.

This breaks backwards-compat for clients that send a wrapper-level msg_* id while also including per-event session IDs.

Expected

• If events[] contains valid opencode_session_id values, the request should be accepted regardless of the top-level opencode_session_id value.

Actual

• The request returns 400 when the top-level opencode_session_id starts with msg_.

Proposed fix

• Only validate/reject a msg_* session id when it is actually used as the default session id for an event.
• Add a regression test covering:
  • top-level opencode_session_id = msg_*
  • per-event opencode_session_id = sess-*
  • request is accepted and events are recorded.

Acceptance criteria

• The scenario above returns 200 and records events.
• Test added.

[kunickiaj]

Current triage: still relevant and likely still reproducible.

In the current TS viewer route (packages/viewer-server/src/routes/raw-events.ts), the request still rejects a top-level default session id starting with msg_ before finishing the per-event fallback path. That means the backwards-compat scenario described here still appears plausible.

Keeping this open as a current TS raw-events bug.