feat(pilot): inline Script Builder session — idempotent create + auth + filtered list

POST /script-builder/sessions now supports origin='pilot_inline':
- Requires ai_session_id; validates it against current user ownership.
- Get-or-create: returns existing row for (user, ai_session_id) pair.
- Partial unique index on the DB backs the invariant; races resolve to
  the single winner row.

list_sessions + count_user_sessions default-scope to origin='standalone'
so inline scratch sessions don't pollute the /script-builder dashboard
or count against the 5-session cap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/services/script_builder_service.py

@@ -148,6 +148,8 @@ async def create_session(
     team_id: UUID | None,
     language: str,
     initial_prompt: str | None = None,
+    origin: str = "standalone",
+    ai_session_id: UUID | None = None,
 ) -> ScriptBuilderSession:
     """Create a new Script Builder session."""
     session = ScriptBuilderSession(
@@ -155,6 +157,8 @@ async def create_session(
         account_id=account_id,
         team_id=team_id,
         language=language,
+        origin=origin,
+        ai_session_id=ai_session_id,
     )
     db.add(session)
     await db.flush()
@@ -295,15 +299,22 @@ async def list_sessions(
     user_id: UUID,
     limit: int = 20,
     offset: int = 0,
+    *,
+    include_inline: bool = False,
 ) -> list[ScriptBuilderSession]:
-    """List user's builder sessions ordered by updated_at desc."""
-    result = await db.execute(
+    """List user's builder sessions ordered by updated_at desc.
+
+    By default (include_inline=False) excludes pilot_inline sessions so the
+    /script-builder dashboard only shows standalone sessions.
+    """
+    stmt = (
         select(ScriptBuilderSession)
         .where(ScriptBuilderSession.user_id == user_id)
-        .order_by(ScriptBuilderSession.updated_at.desc())
-        .limit(limit)
-        .offset(offset)
     )
+    if not include_inline:
+        stmt = stmt.where(ScriptBuilderSession.origin == "standalone")
+    stmt = stmt.order_by(ScriptBuilderSession.updated_at.desc()).limit(limit).offset(offset)
+    result = await db.execute(stmt)
     return list(result.scalars().all())
 
 
@@ -321,13 +332,23 @@ async def delete_session(
     return True
 
 
-async def count_user_sessions(db: AsyncSession, user_id: UUID) -> int:
-    """Count active builder sessions for a user."""
-    result = await db.execute(
-        select(func.count(ScriptBuilderSession.id)).where(
-            ScriptBuilderSession.user_id == user_id
-        )
+async def count_user_sessions(
+    db: AsyncSession,
+    user_id: UUID,
+    *,
+    include_inline: bool = False,
+) -> int:
+    """Count active builder sessions for a user.
+
+    By default (include_inline=False) excludes pilot_inline sessions so they
+    don't consume slots against the MAX_SESSIONS_PER_USER cap.
+    """
+    stmt = select(func.count(ScriptBuilderSession.id)).where(
+        ScriptBuilderSession.user_id == user_id
     )
+    if not include_inline:
+        stmt = stmt.where(ScriptBuilderSession.origin == "standalone")
+    result = await db.execute(stmt)
     return result.scalar_one()