feat(#2): consume GET /sessions/{id}/tools — Tools-pane inventory hydrate

v1 coverage-audit Tier-2 quick win. The owner-scoped tool-inventory
endpoint (#183) had no caller; wire it into the TUI Tools pane.

- sessions.py: get_session_tools (GET /sessions/{id}/tools) — owner-
  scoped (consumer key, no admin scope), 200 -> parsed dict verbatim,
  non-200 -> SessionApiFailed. Mirrors get_persona_state / get_me.
- tui.py: _format_tool_inventory helper + _hydrate_session_tools
  best-effort worker (mirrors _hydrate_persona), wired unconditionally
  in on_mount. Writes the merged {agent_id, builtin_tools,
  bifrost_tools} inventory the LLM saw at turn-fire into the Tools
  pane + audits; never crashes on failure.
- Covers the design-brief 5 "Tools widget" via the reachable owner
  endpoint (the admin variant stays a gap only for cross-user debug).
- Contract #2 amended (FN) + validated. TDD: 3 wrapper tests + 1
  format-helper unit + 2 hydrate integration tests. Coverage: REST
  10/40. Suite 544 green; touched code ruff-clean.

tests/test_sessions.py

@@ -21,6 +21,7 @@ from ratatoskr.sessions import (
     get_capabilities,
     get_me,
     get_persona_state,
+    get_session_tools,
     list_agents,
     list_sessions,
 )
@@ -991,3 +992,50 @@ class TestGetCapabilities:
             with pytest.raises(SessionApiFailed) as exc:
                 await get_capabilities(client)
         assert exc.value.status == 500
+
+
+class TestGetSessionTools:
+    """docs/contracts/issues/2.contract.md — get_session_tools (GET /sessions/{id}/tools, #183)."""
+
+    @respx.mock
+    async def test_happy(self) -> None:
+        """happy [happy,tracer]: 200 → merged tool inventory dict verbatim."""
+        respx.get("https://w.example/sessions/s1/tools").mock(
+            return_value=httpx.Response(
+                200,
+                json={
+                    "agent_id": "alice:wizard",
+                    "builtin_tools": [],
+                    "bifrost_tools": [
+                        {"name": "bifrost.alice.set_field", "description": "d", "parameters": {}}
+                    ],
+                },
+            )
+        )
+        async with httpx.AsyncClient(base_url="https://w.example") as client:
+            tools = await get_session_tools(client, "s1")
+        assert tools["agent_id"] == "alice:wizard"
+        assert tools["builtin_tools"] == []
+        assert tools["bifrost_tools"][0]["name"] == "bifrost.alice.set_field"
+
+    @respx.mock
+    async def test_cross_owner_404_raises(self) -> None:
+        """cross_owner_404 [error]: 404 session_not_found → SessionApiFailed(404)."""
+        respx.get("https://w.example/sessions/s1/tools").mock(
+            return_value=httpx.Response(404, json={"error_code": "session_not_found"})
+        )
+        async with httpx.AsyncClient(base_url="https://w.example") as client:
+            with pytest.raises(SessionApiFailed) as exc:
+                await get_session_tools(client, "s1")
+        assert exc.value.status == 404
+
+    @respx.mock
+    async def test_empty_session_id_asserts(self) -> None:
+        """empty_session_id [adversarial]: '' → AssertionError; no HTTP issued."""
+        route = respx.get("https://w.example/sessions//tools").mock(
+            return_value=httpx.Response(200, json={})
+        )
+        async with httpx.AsyncClient(base_url="https://w.example") as client:
+            with pytest.raises(AssertionError):
+                await get_session_tools(client, "")
+        assert route.call_count == 0