refactor: move mode validation into AgentSession implementations

Move mode validation from AgentManager into the individual AgentSession
implementations (ClaudeAgentSession and CodexAgentSession) where it belongs.

Each session validates modes in:
- Constructor (when config.modeId is provided)
- setMode() method (when mode is changed)

This follows the principle that the AgentManager is a coordinator while
the AgentSession is the authority on what modes it supports.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

packages/server/src/server/agent/providers/claude-agent.ts

@@ -72,7 +72,7 @@ const DEFAULT_MODES: AgentMode[] = [
   },
 ];
 
-export const VALID_CLAUDE_MODES = new Set(
+const VALID_CLAUDE_MODES = new Set(
   DEFAULT_MODES.map((mode) => mode.id)
 );
 
@@ -271,6 +271,15 @@ class ClaudeAgentSession implements AgentSession {
     this.claudeSessionId = handle?.sessionId ?? handle?.nativeHandle ?? null;
     this.pendingLocalId = this.claudeSessionId ?? `claude-${randomUUID()}`;
     this.persistence = handle ?? null;
+
+    // Validate mode if provided
+    if (config.modeId && !VALID_CLAUDE_MODES.has(config.modeId)) {
+      const validModesList = Array.from(VALID_CLAUDE_MODES).join(", ");
+      throw new Error(
+        `Invalid mode '${config.modeId}' for Claude provider. Valid modes: ${validModesList}`
+      );
+    }
+
     this.currentMode = (config.modeId as PermissionMode) ?? "default";
     if (this.claudeSessionId) {
       this.loadPersistedHistory(this.claudeSessionId);
@@ -386,6 +395,14 @@ class ClaudeAgentSession implements AgentSession {
   }
 
   async setMode(modeId: string): Promise<void> {
+    // Validate mode
+    if (!VALID_CLAUDE_MODES.has(modeId)) {
+      const validModesList = Array.from(VALID_CLAUDE_MODES).join(", ");
+      throw new Error(
+        `Invalid mode '${modeId}' for Claude provider. Valid modes: ${validModesList}`
+      );
+    }
+
     const normalized = modeId as PermissionMode;
     const query = await this.ensureQuery();
     await query.setPermissionMode(normalized);