nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/mcp/server.go

@@ -14,6 +14,8 @@ import (
 	"time"
 
 	"github.com/dtoro/oikos/internal/db"
+	"github.com/dtoro/oikos/internal/db/sqlcgen"
+	"github.com/dtoro/oikos/internal/observability"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/google/uuid"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
@@ -968,13 +970,27 @@ func resolveHost(ctx context.Context, pool *db.Pool, entitySlug string) (hostIP
 }
 
 func createApproval(ctx context.Context, pool *db.Pool, execID, targetID uuid.UUID, action, params, riskClass string) {
-	approvalID, _ := uuid.NewV7()
 	payload := fmt.Sprintf(`{"action":"%s","params":"%s","execution_id":"%s"}`, action, params, execID)
-	pool.Exec(ctx, `
+	// approvals.entity_id is PK + FK to entities(id). Reuse the execution's
+	// entity (already inserted by request_execution) so the FK is satisfied —
+	// a fresh UUID here had no matching entities row, so the INSERT silently
+	// failed, orphaning the execution and never alerting the operator. One
+	// execution maps to at most one approval, so the 1:1 identity holds.
+	if _, err := pool.Exec(ctx, `
 		INSERT INTO approvals (entity_id, subject_entity_id, action, risk_class,
 			kind, payload, status, expires_at, created_at)
 		VALUES ($1, $2, $3, $4, 'execution', $5::jsonb, 'pending',
 			now() + interval '1 hour', now())`,
-		approvalID, targetID, action, riskClass, payload)
-	pool.Exec(ctx, `UPDATE executions SET approval_id = $2 WHERE entity_id = $1`, execID, approvalID)
+		execID, targetID, action, riskClass, payload); err != nil {
+		slog.Error("createApproval: insert approval", "error", err, "execution", execID)
+		return
+	}
+	if _, err := pool.Exec(ctx, `UPDATE executions SET approval_id = $1 WHERE entity_id = $1`, execID); err != nil {
+		slog.Error("createApproval: link approval to execution", "error", err, "execution", execID)
+	}
+
+	// Emit for SSE fan-out — the operator-facing moment: an agent-requested
+	// gated action is now awaiting a decision.
+	_ = observability.Event(ctx, sqlcgen.New(pool), "approval.created", &execID, "warning", "mcp", "",
+		map[string]any{"action": action, "params": params, "risk_class": riskClass})
 }