refactor(cli): split normalizeSession to reduce cyclomatic complexity

[ericksoa]

Issue

normalizeSession in src/lib/onboard-session.ts has an eslint complexity waiver (eslint-disable-next-line complexity). It handles schema coercion, redaction, defaults, metadata normalization, and step normalization in one function.

Fix

Extract helpers like coerceSessionFields, normalizeMetadata, and normalizeSteps so the waiver can be removed and the function stays under the complexity limit (target: 15).

Found by

CodeRabbit review on #1272. Pre-existing from original JS.