fix: session-aware HTTP endpoints — env state persists across reset/step calls

fix: openenv validate passes, strict grader scores, /grader+/tasks endpoints, server/app.py main(), uv.lock