feat: implement Tier 3 features — lane queue, credential redaction, token dashboard, xAI, Voyage AI

- Lane Queue: per-session FIFO queue in gateway replacing reject-when-busy (9 tests)
- Credential Redaction: redactConfig() expanded to cover 18+ secret fields (16 tests)
- Web UI Token Dashboard: system.tokenUsage endpoint + Usage page with summary cards
- xAI (Grok) Provider: OpenAI-compatible client with model pricing
- Voyage AI Embeddings: new embedding provider with configurable dimensions (5 tests)
- Update gap analysis: 90→95 match (70%→74%), Tier 3 section marked DONE
- Update state.json: test count 1001→1034, add tier3_completion entry

Total: 1034 tests passing across 85 files, typecheck clean

src/gateway/handlers/agent.ts

@@ -2,10 +2,12 @@ import type { GatewayRequest, GatewayAttachment, OutboundMessage } from '../prot
 import type { SendFn } from '../router.js';
 import { makeEvent, makeError, ErrorCode } from '../protocol.js';
 import type { SessionBridge } from '../session-bridge.js';
+import type { LaneQueue } from '../lane-queue.js';
 import type { Attachment } from '../../channels/types.js';
 
 export interface AgentHandlerDeps {
   sessionBridge: SessionBridge;
+  laneQueue: LaneQueue;
 }
 
 export function createAgentHandlers(deps: AgentHandlerDeps) {
@@ -21,51 +23,56 @@ export function createAgentHandlers(deps: AgentHandlerDeps) {
         return makeError(request.id, ErrorCode.InvalidRequest, 'connectionId is required (set by server)');
       }
 
-      if (deps.sessionBridge.isBusy(connectionId)) {
-        return makeError(request.id, ErrorCode.AgentBusy, 'Agent is already processing a request');
-      }
-
       const agent = deps.sessionBridge.getAgent(connectionId);
       if (!agent) {
         return makeError(request.id, ErrorCode.SessionNotFound, 'No agent for this connection');
       }
 
-      deps.sessionBridge.setBusy(connectionId, true);
+      // Queue by session ID so multiple connections sharing a session are serialised.
+      // Falls back to connectionId if session lookup fails (shouldn't happen).
+      const sessionId = deps.sessionBridge.getSessionId(connectionId);
+      const laneId = sessionId ?? connectionId;
 
-      // Set up tool use callback to emit streaming events
-      deps.sessionBridge.setOnToolUse(connectionId, (event) => {
-        if (event.type === 'start') {
-          send(makeEvent(request.id, 'tool_start', { tool: event.tool, args: event.args }));
-        } else if (event.type === 'end') {
-          send(makeEvent(request.id, 'tool_end', {
-            tool: event.tool,
-            result: event.result ? {
-              success: event.result.success,
-              output: event.result.output,
-              error: event.result.error,
-            } : undefined,
+      // Enqueue the work — if the lane is idle it runs immediately,
+      // otherwise it waits for earlier requests on the same session to finish.
+      return deps.laneQueue.enqueue(laneId, async () => {
+        deps.sessionBridge.setBusy(connectionId, true);
+
+        // Set up tool use callback to emit streaming events
+        deps.sessionBridge.setOnToolUse(connectionId, (event) => {
+          if (event.type === 'start') {
+            send(makeEvent(request.id, 'tool_start', { tool: event.tool, args: event.args }));
+          } else if (event.type === 'end') {
+            send(makeEvent(request.id, 'tool_end', {
+              tool: event.tool,
+              result: event.result ? {
+                success: event.result.success,
+                output: event.result.output,
+                error: event.result.error,
+              } : undefined,
+            }));
+          }
+        });
+
+        try {
+          // Convert gateway attachments to channel attachments
+          const attachments: Attachment[] | undefined = params.attachments?.map(a => ({
+            mimeType: a.mimeType,
+            data: a.data,
+            url: a.url,
+            filename: a.filename,
           }));
+
+          const response = await agent.process(params.message!, attachments);
+          send(makeEvent(request.id, 'done', { content: response }));
+        } catch (err) {
+          const message = err instanceof Error ? err.message : 'Unknown error';
+          send(makeEvent(request.id, 'error', { code: ErrorCode.InternalError, message }));
+        } finally {
+          deps.sessionBridge.setBusy(connectionId, false);
+          deps.sessionBridge.setOnToolUse(connectionId, undefined);
         }
       });
-
-      try {
-        // Convert gateway attachments to channel attachments
-        const attachments: Attachment[] | undefined = params.attachments?.map(a => ({
-          mimeType: a.mimeType,
-          data: a.data,
-          url: a.url,
-          filename: a.filename,
-        }));
-
-        const response = await agent.process(params.message, attachments);
-        send(makeEvent(request.id, 'done', { content: response }));
-      } catch (err) {
-        const message = err instanceof Error ? err.message : 'Unknown error';
-        send(makeEvent(request.id, 'error', { code: ErrorCode.InternalError, message }));
-      } finally {
-        deps.sessionBridge.setBusy(connectionId, false);
-        deps.sessionBridge.setOnToolUse(connectionId, undefined);
-      }
     },
 
     'agent.cancel': async (request: GatewayRequest): Promise<OutboundMessage> => {