nomos+web: streaming, provider routing, event gap-fill, embedded UI; fix approval FK & session context

Agent (cmd/nomos):
- Stream LLM tokens via NewStreaming; emit text_delta then final text.
- OpenRouter provider routing: data_collection=deny (ZDR) + require_parameters;
  NOMOS_PROVIDER_SORT opt-in; Exacto via model suffix.
- Multi-turn: reload session history into context; UI passes session id.
- Fix agent_activity logging (agent_id/session_id) and mcpClient data race.

Events (live control-room feed):
- approval.created (mcp), approval.decided (api), execution.completed/failed
  (approved-action path), signal.raised/resolved + health.changed (scheduler,
  transition-gated).

Fixes:
- createApproval FK violation (reuse execution entity) — the agent's only
  write path; log the previously-swallowed errors.

Web UI:
- Embed web/dist via //go:embed (single binary); Dockerfile builds SPA into
  the Go stage; committed .gitkeep placeholder keeps backend-only builds green.
- Caddy: Authentik-gated /agent/* -> nomos so the UI reaches the agent
  same-origin in production.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

web/src/pages/Sessions.svelte

@@ -0,0 +1,90 @@
+<script lang="ts">
+  import { sessions, loadSessions, loadSessionMessages, messages, currentSession } from '$lib/stores/chat'
+  import { onMount } from 'svelte'
+
+  onMount(() => {
+    loadSessions()
+  })
+</script>
+
+<div class="sessions-page">
+  <h2>Sessions</h2>
+  <div class="session-list">
+    {#each $sessions as session (session.id)}
+      <button
+        class="session-card"
+        class:active={$currentSession === session.id}
+        onclick={() => loadSessionMessages(session.id)}
+      >
+        <div class="session-title">{session.title || 'Untitled'}</div>
+        <div class="session-meta">
+          {new Date(session.last_active_at).toLocaleString()}
+        </div>
+      </button>
+    {:else}
+      <div class="empty">No sessions yet. Start chatting with Nomos.</div>
+    {/each}
+  </div>
+</div>
+
+<style>
+  .sessions-page {
+    max-width: 720px;
+    margin: 0 auto;
+    padding: 2rem 1rem;
+  }
+
+  h2 {
+    font-size: 1.125rem;
+    font-weight: 600;
+    margin-bottom: 1rem;
+    color: var(--text);
+  }
+
+  .session-list {
+    display: flex;
+    flex-direction: column;
+    gap: 0.5rem;
+  }
+
+  .session-card {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 0.75rem 1rem;
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    cursor: pointer;
+    color: var(--text);
+    font-family: inherit;
+    font-size: 0.875rem;
+    text-align: left;
+    transition: border-color 0.15s;
+  }
+
+  .session-card:hover {
+    border-color: var(--accent-blue);
+  }
+
+  .session-card.active {
+    border-color: var(--accent-blue);
+    background: var(--bg-hover);
+  }
+
+  .session-title {
+    font-weight: 500;
+  }
+
+  .session-meta {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+  }
+
+  .empty {
+    color: var(--text-muted);
+    font-size: 0.875rem;
+    padding: 2rem 0;
+    text-align: center;
+  }
+</style>