Add persistent agent messaging and shared chat bubbles

Connect Sybil to the Pi root conversation with authenticated REST and WebSocket
APIs, persistent read state, and a dedicated agent tab. Keep optimistic messages
stable through delivery and retries, and animate arrivals without losing the
reader's scroll position.

Share bubble styling with regular chats and remove the obsolete admission sender.
Reject malformed upstream receipts and WebSocket upgrade requests, with regression
coverage and updated API documentation.

Validated with 51 web tests, 44 server tests, both production builds, desktop/mobile
bubble comparisons, and 11 browser animation and scrolling checks.

docs/api/streaming-chat.md

@@ -1,6 +1,6 @@
 # Streaming Chat API Contract
 
-This document defines the server-sent events (SSE) contract for chat completions and Quick Questions.
+This document defines the server-sent events (SSE) contract for chat completions and Quick Questions, and the WebSocket contract for the persistent Agent room.
 
 Endpoint:
 - `POST /v1/chat-completions/stream`
@@ -275,3 +275,62 @@ event: done
 data: {"type":"done","text":"Hello world"}
 
 ```
+
+## Persistent Agent WebSocket
+
+`GET /v1/agent/ws` upgrades to a continuous WebSocket room subscription. Behind the
+web proxy use `/api/v1/agent/ws`, with `ws:` or `wss:` matching the page. It remains
+connected after each assistant turn and receives later background results. Sending
+messages uses `POST /v1/agent/messages`.
+
+The browser must send this first frame within five seconds:
+
+```json
+{ "type": "auth", "token": "Sybil token", "after": "43" }
+```
+
+In open mode, use `token: null`. Omit `after` for recent history; on reconnect supply
+the last successfully merged cursor. Invalid credentials close with 4401, malformed
+initial frames with 4400. Malformed upgrade URLs and query parameters are rejected
+with HTTP 400; unknown upgrade paths return HTTP 404. Never put tokens in URLs.
+Sybil adds its private Pi credential only to the upstream Authorization header;
+browser credentials are not forwarded to Pi.
+
+Native `pi-room.v1` frames are forwarded after authentication:
+
+```json
+{ "type": "ready", "protocol": "pi-room.v1", "conversationId": "1", "model": "..." }
+```
+
+```json
+{
+  "type": "messages",
+  "conversationId": "1",
+  "messages": [{ "id": "outbound:44", "role": "assistant", "content": "The result is ready.", "createdAt": "2026-10-14T18:00:00.000Z", "metadata": { "kind": "message", "entryId": 44, "status": "complete" } }],
+  "cursor": "44",
+  "beforeCursor": "44",
+  "hasMore": false
+}
+```
+
+```json
+{ "type": "activity", "conversationId": "1", "activity": { "state": "thinking", "isThinking": true, "queued": 0, "backgroundWorkers": 0, "tools": [], "queuedMessages": [] } }
+```
+
+Activity is forwarded from Pi and also describes tools, queued messages, durable
+waiting, errors, and workers. Use `isThinking` for the thinking indicator and
+`backgroundWorkers` for ongoing delegated work; no model reasoning is exposed. Tools arrive as `role: "tool"` messages
+with `metadata.kind: "tool_call"`, matching Sybil's tool renderer. REST pages and
+socket messages are upserts keyed by stable `id`. Save each returned cursor after
+applying its entire frame, even when it contains no visible messages.
+
+Clients may send `{ "type": "ping" }` (receiving `{ "type": "pong" }`) or
+`{ "type": "subscribe", "after": "44" }` to change the replay cursor. Transport
+ping/pong heartbeats detect dead connections. Other writes belong on REST.
+Errors use `{ "type": "error", "error": "..." }`. Upstream loss closes with 1011
+or 1012; slow consumers may receive 1013. Reconnect with backoff and the last merged
+cursor. Missing Pi configuration closes with 4503.
+
+The proxy closes upstream sockets when browsers leave or Sybil shuts down.
+History remains durable in Pi. Shared read position is separate from delivery:
+update `GET`/`PUT /v1/agent/read-state` only when messages have actually been viewed.