feat(gateway): add WebSocket gateway with JSON-RPC protocol and auth

Phase 2 of the Flynn roadmap. Adds a WebSocket gateway server that
starts alongside the Telegram bot, providing real-time API access to
the agent, sessions, and tools.

Protocol: JSON-RPC-like (request/response/event) over WebSocket.
8 methods: agent.send, agent.cancel, sessions.list, sessions.history,
sessions.create, tools.list, tools.invoke, system.health.

Auth: Bearer token + Tailscale identity header support.
Session bridge: per-connection agent instances with shared model router.

New files: src/gateway/ (protocol, router, server, auth, session-bridge,
handlers for agent/sessions/tools/system).
57 new tests (181 total), typecheck clean.

package.json

@@ -28,6 +28,7 @@
     "@types/marked-terminal": "^6.1.1",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
+    "@types/ws": "^8.18.1",
     "eslint": "^9.0.0",
     "tsx": "^4.0.0",
     "typescript": "^5.7.0",
@@ -45,6 +46,7 @@
     "ollama": "^0.5.0",
     "openai": "^4.0.0",
     "react": "^19.0.0",
+    "ws": "^8.19.0",
     "yaml": "^2.7.0",
     "zod": "^3.24.0"
   },