fix: align freebuff session protocol with model binding

[Biaogo94]

Summary

This aligns Freebuff2API with the current Freebuff waiting-room/session contract and removes an overstated README claim.

Changes

• send x-freebuff-model on POST /api/v1/freebuff/session so session admission matches the requested model
• track the current token/session model in the run manager and expose it in health snapshots
• switch a token's session and runs when the requested model changes, but only when that token is idle
• treat session_model_mismatch as a retryable session/run reset signal
• update the README feature list to describe actual session compatibility instead of claiming dynamic fingerprint mimicry

Why

Freebuff sessions are now model-bound upstream. Without model selection on session creation, the proxy can end up reusing a session that is locked to a different model and trigger session_model_mismatch errors.

The previous README wording also claimed "Stealth Request Handling" with dynamic randomized fingerprints, but the implementation only used a fixed user-agent plus request metadata. This PR makes the docs match reality.

Notes

I could not run gofmt or Go tests in this workspace because the Go toolchain is not installed here. I did run reference and diff checks locally while preparing the patch.

[Biaogo94]

Superseded by #13, which consolidates the live-verified session protocol fixes together with the current Responses compatibility work.