Validate that abandoned assistant sessions age out server-side (add cleanup if they don't)

## Context

In #1690, submitting a new question from the home-page hero deliberately clears the client's session pointer (`sessionIdRef` + localStorage) **before** the send, so a reload can't resurrect the conversation the user just abandoned (see the accepted resolution of [this review thread](https://github.com/galaxyproject/brc-analytics/pull/1690#discussion_r3891760537)). The client never calls `assistantDeleteSession` for the abandoned session, so the session object and its conversation history remain on the server.

Whether this is an actual leak depends on backend behavior we haven't verified: assistant conversations are believed to age out server-side, but that needs to be confirmed before deciding anything.

## Validate first

- [ ] Confirm whether the assistant backend expires/reaps stale sessions (TTL, scheduled cleanup, or similar), and on what schedule.
- [ ] Confirm the expiry covers sessions abandoned via the hero flow above **and** sessions abandoned by simply closing the tab.

## If (and only if) there is no aging-out

Pick one or both:

- Client: fire-and-forget `assistantDeleteSession(oldSessionId)` at the point the hook abandons the session (where it nulls the ref and removes the localStorage key). Failure-tolerant — the client has already moved on.
- Server: add TTL/reaping of stale sessions (also covers the closed-tab case, which a client-side delete can't).

If expiry is confirmed adequate, close this with a note documenting the retention behavior.

Start with the hero-flow changes from #1690, following sessionIdRef, the localStorage key, and assistantDeleteSession at the point the hook abandons a session. Verify the assistant backend's TTL or cleanup behavior for both hero abandonment and closed tabs. Done means documenting adequate retention and closing the issue, or implementing the selected client or server cleanup and verifying it.

Written by the indexing model from the issue text.