nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/embed.go

@@ -0,0 +1,21 @@
+// Package web embeds the compiled control-room SPA (web/dist) into the oikos
+// binary, preserving the single-binary deployment (ADR-0001). The dist tree is
+// produced by `npm run build` (or the Docker ui-builder stage); a committed
+// web/dist/.gitkeep keeps a backend-only `go build` green when the UI has not
+// been built.
+package web
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed all:dist
+var dist embed.FS
+
+// DistFS returns the built SPA rooted at dist/. When the UI has not been built
+// (only the .gitkeep placeholder is present), Open("index.html") will fail and
+// the caller serves a 404 — the binary still starts.
+func DistFS() (fs.FS, error) {
+	return fs.Sub(dist, "dist")
+}