fix(sessions): send profile in destructive bodies and prune the asked window (#1398)

Co-authored-by: M57 <41645758+Hy4ri@users.noreply.github.com>

app/src/main/java/com/m57/hermescontrol/data/model/SessionListResponse.kt

@@ -123,7 +123,10 @@ data class SessionRenameRequest(
 @Serializable
 data class BulkDeleteRequest(
     val ids: List<String>,
-    val delete_all: Boolean = false,
+    // Destructive POSTs read the profile off the BODY (not the ?profile=
+    // query rewrite) — an unnamed bulk delete is refused with 400 on a
+    // multi-profile backend. Null stays valid for single-profile hosts.
+    val profile: String? = null,
 )
 
 @Serializable
@@ -134,5 +137,13 @@ data class BulkDeleteResponse(
 
 @Serializable
 data class PruneRequest(
-    val days: Int,
+    // Server contract: `older_than_days` (hermes_cli/web_models.py SessionPrune).
+    // The old `days` key was unknown to the backend, so the user's choice was
+    // silently dropped and the server pruned its own 90-day default.
+    @SerialName("older_than_days") val olderThanDays: Int,
+    // Destructive POSTs read the profile off the BODY (not the ?profile= query
+    // rewrite): on a multi-profile backend an unnamed prune is refused with
+    // 400 (web_routers/_common.py destructive_profile). Null stays valid for
+    // single-profile hosts.
+    val profile: String? = null,
 )

app/src/main/java/com/m57/hermescontrol/data/remote/ProfileScopeInterceptor.kt

@@ -33,6 +33,10 @@ object ProfileScopeInterceptor : Interceptor {
             // multi-profile host transcribes under the launch profile
             // (review, PR #1250).
             "/api/audio",
+            // Curator state is per profile (config-scoped reads) and the run
+            // trigger is privileged: `POST /api/curator/run` is refused with
+            // 400 on a multi-profile backend without ?profile=.
+            "/api/curator",
             "/api/config",
             "/api/credentials/pool",
             "/api/cron",