fix: address 8-domain Oracle review findings (C1, C2, M1-M4)

- C1: thinking-prepend unique part IDs per message (global PK collision)
- C2: recover-thinking-disabled-violation try/catch guard on SDK call
- M1: remove non-schema truncated/originalSize fields from SDK interfaces
- M2: messageHasContentFromSDK treats thinking-only messages as non-empty
- M3: syncAllTasksToTodos persists finalTodos + no-id rename dedup guard
- M4: AbortSignal.timeout(30s) on HTTP fetch calls in opencode-http-api

All 2739 tests pass, typecheck clean.

src/hooks/anthropic-context-window-limit-recovery/empty-content-recovery-sdk.ts

@@ -20,10 +20,15 @@ function messageHasContentFromSDK(message: SDKMessage): boolean {
   const parts = message.parts
   if (!parts || parts.length === 0) return false
 
+  let hasIgnoredParts = false
+
   for (const part of parts) {
     const type = part.type
     if (!type) continue
-    if (IGNORE_TYPES.has(type)) continue
+    if (IGNORE_TYPES.has(type)) {
+      hasIgnoredParts = true
+      continue
+    }
 
     if (type === "text") {
       if (part.text?.trim()) return true
@@ -31,9 +36,12 @@ function messageHasContentFromSDK(message: SDKMessage): boolean {
     }
 
     if (TOOL_TYPES.has(type)) return true
+
+    return true
   }
 
-  return false
+  // Messages with only thinking/meta parts are NOT empty — they have content
+  return hasIgnoredParts
 }
 
 function getSdkMessages(response: unknown): SDKMessage[] {