fix(state): add missing thread locks to 4 SessionDB methods

[teknium1]

Summary

Four SessionDB methods accessed self._conn without acquiring self._lock, while every other method in the class consistently uses the lock:

• search_sessions() — reads sessions table
• clear_messages() — deletes messages + updates session counters + commits
• delete_session() — checks existence + deletes messages + deletes session + commits
• prune_sessions() — selects old sessions + deletes messages + deletes sessions + commits

In the gateway's multi-threaded context (concurrent messages from different platforms/users), these unprotected methods can cause sqlite3.ProgrammingError from concurrent cursor operations on the same connection.

What changed

• hermes_state.py: Wrapped each method body in with self._lock:

Test plan

• python -m pytest tests/test_hermes_state.py -n0 -q → 109 passed ✔
• Gateway under concurrent load: no more intermittent SQLite errors on session cleanup/listing