feat(sessions): add get_user_state(app_name, user_id) to BaseSessionService

[nicolasmota]

Link to Issue or Description of Change

Closes: #5592

Problem:
BaseSessionService has no public method to read user-scoped state without an active session_id. Callers that need to bootstrap user context before a new session exists are forced to call the expensive list_sessions or maintain a separate process-level cache as a workaround.

Solution:
Add get_user_state(app_name, user_id) -> dict[str, Any] to BaseSessionService. Implemented in InMemorySessionService, DatabaseSessionService, and SqliteSessionService. VertexAiSessionService raises NotImplementedError because the Vertex AI Agent Engine API does not expose user state independently of a session. The default in BaseSessionService also raises NotImplementedError to preserve backward compatibility for existing custom subclasses.

Keys are returned without the user: prefix, consistent with how user state is stored internally (the prefix is applied by the state-merging layer).

---

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

New test file: tests/unittests/sessions/test_get_user_state.py — 19 test cases parameterised across IN_MEMORY, DATABASE, and SQLITE backends covering:

• Returns {} when no state exists
• Returns only user-scoped keys (session keys are excluded)
• State is isolated per user — different users see {}
• State is isolated per app — different apps see {}
• Core use case: state readable before a new session_id is created
• Latest write wins (overwrite semantics)
• VertexAiSessionService raises NotImplementedError

platform darwin -- Python 3.11.12, pytest-9.0.2 19 passed in 2.33s

Manual E2E Tests:

Not applicable for this change — the method is a read-only query on existing storage with no behavioural side-effects on session or event handling. Existing E2E tests are unaffected.

---

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.