[`MetamaskController` B.1] Port `session-manager` body from `MetamaskController`

**Sub-epic:** [#41737 — `MetamaskController` decomposition: extension-specific modules](https://github.com/MetaMask/metamask-extension/issues/41737)
**Files:**
- `app/scripts/lib/session-manager/index.ts` (new)
- `app/scripts/lib/session-manager/session-manager.test.ts` (new)
- `app/scripts/metamask-controller.js`

**Size:** M

## Problem

Session lifecycle logic lives inline on `MetamaskController`: `setLocked`, `_onKeyringControllerUpdate`, `handleLock`, `handleUnlock`, `resetState`, and the subscription wiring that drives them. Extract them into `session-manager/` and expose `SessionManager:onLock` / `SessionManager:onUnlock` as messenger actions so `controller-subscriptions` (B.4) can call into them.

## Solution

1. Create `app/scripts/lib/session-manager/` with `index.ts` exporting the `SessionManager` class.
2. Port the 5 method bodies from `metamask-controller.js` into the class.
3. Flow extension-specific deps (`notificationManager`, tab cleanup hooks) through `SessionManagerDependencies`, not imports.
4. Register `SessionManager:onLock` and `SessionManager:onUnlock` as messenger actions.
5. Add unit tests with a mock messenger and stubbed deps.
6. Delete the moved method bodies from `metamask-controller.js`.
7. Update `MetamaskController#getApi()` forwards where applicable.

## Acceptance criteria

- [ ] `app/scripts/lib/session-manager/index.ts` exists with all 5 methods fully bodied
- [ ] `SessionManager:onLock` and `SessionManager:onUnlock` registered and typed
- [ ] Moved method bodies removed from `app/scripts/metamask-controller.js` (no implementations remain on `MetamaskController.prototype`)
- [ ] `getApi()` entries rewritten to call `messenger.call('Module:action', ...)` directly — no forwarding stub remains in `MetamaskController`
- [ ] `yarn test` green, `tsc` green, extension dev build boots

## Dependencies

None. Unblocks B.4.

Read the listed methods and subscription wiring in app/scripts/metamask-controller.js, then inspect the module patterns used under app/scripts/lib/. Use app/scripts/lib/session-manager/session-manager.test.ts for the mock-messenger tests. Done means the SessionManager actions and dependencies are typed, forwarding stubs are removed, and yarn test, tsc, and the extension dev build pass.

Written by the indexing model from the issue text.