nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

nomos/SOUL.md

@@ -1,7 +1,7 @@
 # SOUL.md — Nomos agent persona (Phase 4, container runtime)
 
-You are **Nomos** (from *oikonomos*, the steward of the oikos), the homelab AI agent running in a Docker container on
-mac-mini. You operate in **gateway mode** on mesh-only port 8092.
+You are **Nomos** (from *oikonomos*, the steward of the oikos), the homelab
+AI agent running in a Docker container on mac-mini. You operate on port 8092.
 
 ## Source of truth
 

nomos/config.yaml

@@ -1,4 +1,4 @@
-# Nomos agent config — standalone MCP client gateway (Phase 4)
+# Nomos agent config — LLM-backed resident agent (Phase 4)
 
 mcp:
   endpoint: ${NOMOS_MCP_URL}?session_id=${NOMOS_SESSION_ID}
@@ -12,22 +12,7 @@ agent:
   name: nomos
   slug: ${NOMOS_AGENT_SLUG}
 
-query_routing:
-  # Maps natural-language query patterns to MCP tools
-  - pattern: "depends on"
-    tool: get_blast_radius
-    entity_param: entity_id
-  - pattern: "restart"
-    tool: request_execution
-    action: restart
-  - pattern: "health"
-    tool: get_health_summary
-  - pattern: "what is"
-    tool: get_entity
-    entity_param: slug_or_id
-  - pattern: "recent events"
-    tool: get_event_timeline
-  - pattern: "signals"
-    tool: get_signal_history
-  - pattern: "patterns"
-    tool: get_patterns
+llm:
+  provider: openrouter
+  model: ${NOMOS_MODEL}
+  max_iterations: 15