Bug: Desktop startup stalls indefinitely after unclean TUI exit while using a local model endpoint

When a user points /model at a local loopback endpoint and exits the TUI uncleanly, the session's ended_at stays NULL, causing the next Desktop launch to synchronously retry the dead endpoint and block the backend event loop for 60-100+ seconds, producing a startup timeout.