Omnia needs a backend

Omnia has a well-designed simulation engine (the packages/* workspace) but it has no independent backend/runtime service. Everything that would normally live in a backend like session lifecycle, turn orchestration, model routing, state persistance and config/credential management is implemented inside apps/gui and reachable only through Next.js Server Actions.

The "GUI" is currently performing several functions:

• a rendering layer
• an RPC/API layer
• a stateful runtime host.

What Needs to be done

• #36
• Put an API boundary in front of it using REST/tRPC/WebSocket instead of Server Actions as the only contract. Server Actions can remain the client's way of talking to that API, but the API should be independently callable and versioned.
• Replace client-driven polling with server-driven ticking. A background worker (queue, cron, or a long-lived process with its own event loop) should own turn advancement so turn orchestration is decoupled from the browser tab.
• Separate session durability from the web process's local disk — even just moving data/ to a shared volume/DB service removes the single-instance constraint, and is a prerequisite for any multi-replica deployment.
• Bring the turn-executor/alias-handoff logic under the existing Tier 1/2/3 testing discipline once it's a package which is the highest-value testing gap in the repo today.
• Add an auth/secrets boundary or encrypt stored provider API keys and gate the config/provider-CRUD actions.

Start by mapping the session, turn orchestration, model routing, persistence, and config logic currently in apps/gui and the packages/* workspace. Review the existing Server Actions, data/ storage, turn-executor/alias-handoff logic, and Tier 1/2/3 tests; done requires an independently callable, durable, authenticated backend with server-owned ticking and corresponding test coverage.