Serialize FullStateSync under the lock insntead of cloning entire session

[arryllopez]

JoinSession handler calls session.clone() to build FullStateSyncPayload. This deep-copies every object, every user, and the entire event log Vec. At 200 objects this is expensive.