nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/oikos/main.go

@@ -4,13 +4,12 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"os"
 	"os/signal"
 	"strings"
 	"syscall"
 
-	"net/http"
-
 	"github.com/dtoro/oikos/internal/config"
 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/httpapi"
@@ -19,9 +18,42 @@ import (
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/dtoro/oikos/internal/scheduler"
 	"github.com/dtoro/oikos/internal/secrets"
+	"github.com/dtoro/oikos/web"
 	"github.com/jackc/pgx/v5"
 )
 
+// uiHandler serves the control-room SPA from assets embedded at build time
+// (web/embed.go), with SPA fallback to index.html. Requests arrive as /ui/*;
+// the /ui prefix is stripped to index into the embedded dist/ tree.
+func uiHandler() http.Handler {
+	dist, err := web.DistFS()
+	if err != nil {
+		slog.Warn("ui: embedded assets unavailable", "error", err)
+		return http.NotFoundHandler()
+	}
+	fileServer := http.FileServer(http.FS(dist))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path := strings.TrimPrefix(strings.TrimPrefix(r.URL.Path, "/ui"), "/")
+		if path == "" {
+			path = "index.html"
+		}
+		if f, err := dist.Open(path); err == nil {
+			f.Close()
+			r.URL.Path = "/" + path
+			fileServer.ServeHTTP(w, r)
+			return
+		}
+		// SPA fallback: serve index.html for unknown client-side routes.
+		if f, err := dist.Open("index.html"); err == nil {
+			f.Close()
+			r.URL.Path = "/index.html"
+			fileServer.ServeHTTP(w, r)
+			return
+		}
+		http.NotFound(w, r)
+	})
+}
+
 var schedulerRunner = scheduler.RunnerForMain()
 var notifierRunner = notifier.RunnerForMain()
 
@@ -86,7 +118,7 @@ func main() {
 		go notifierRunner(ctx, pool, cfg)
 
 		slog.Info("all: starting api with scheduler + notifier in background")
-		if err := httpapi.ListenAndServe(ctx, pool, cfg); err != nil {
+		if err := httpapi.ListenAndServe(ctx, pool, cfg, uiHandler()); err != nil {
 			slog.Error("api failed", "error", err)
 			os.Exit(1)
 		}
@@ -265,7 +297,7 @@ func runAPI(ctx context.Context, cfg config.Config) error {
 		return fmt.Errorf("migrations: %w", err)
 	}
 
-	err = httpapi.ListenAndServe(ctx, pool, cfg)
+	err = httpapi.ListenAndServe(ctx, pool, cfg, uiHandler())
 	if err == http.ErrServerClosed {
 		return nil
 	}