nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compose/oikos/Dockerfile

@@ -1,4 +1,14 @@
 # Multi-stage Dockerfile for Oikos (ADR 0001: single binary)
+# Stage 1: build web UI
+FROM node:22-alpine AS ui-builder
+
+WORKDIR /web
+COPY web/package.json web/package-lock.json ./
+RUN npm ci
+COPY web/ ./
+RUN npm run build
+
+# Stage 2: build Go binary
 FROM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache git ca-certificates
@@ -8,6 +18,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
+# Bring in the built SPA so //go:embed all:dist (web/embed.go) has real assets.
+COPY --from=ui-builder /web/dist ./web/dist
 
 RUN CGO_ENABLED=0 go build -o /oikos -tags timetzdata -ldflags="-s -w" ./cmd/oikos
 
@@ -17,5 +29,6 @@ FROM gcr.io/distroless/static:nonroot
 COPY --from=builder /oikos /oikos
 COPY --from=builder /build/seeds /seeds
 COPY --from=builder /build/migrations /migrations
+# web/dist is embedded in the binary (web/embed.go) — no runtime copy needed.
 
 ENTRYPOINT ["/oikos"]