Support updating a session's `gitHubToken` without recreating the session

## Problem

`gitHubToken` can only be set at session creation (`SessionConfigBase.gitHubToken`). `session.rpc.options.update()` (rpc.d.ts) has no token/auth field, and no other RPC accepts a replacement token for a live session.

If the token backing a session rotates or is revoked externally, there's no way to refresh it in place — every subsequent turn 401s until the host closes and recreates the session, losing session continuity.

## Request

Support updating a running session's `gitHubToken`, re-resolving the GitHub identity the same way session creation does. Either:
1. Allow `gitHubToken` in `SessionUpdateOptionsParams`, or
2. A dedicated RPC (e.g. `session.rpc.auth.refresh({gitHubToken})`)

Session state (history, mode, loaded skills) should be preserved — that's the point of avoiding close+recreate.

先阅读 rpc.d.ts 和 SessionConfigBase，然后跟踪 session.rpc.options.update() 以及会话创建期间使用的 token 处理。定义并实现一条受支持的实时会话更新路径，重新解析 GitHub 身份，并验证 history、mode 和已加载的 skills 仍保持不变。

由索引模型根据 Issue 内容生成。