feat(gateway): add WebSocket gateway with JSON-RPC protocol and auth

Phase 2 of the Flynn roadmap. Adds a WebSocket gateway server that
starts alongside the Telegram bot, providing real-time API access to
the agent, sessions, and tools.

Protocol: JSON-RPC-like (request/response/event) over WebSocket.
8 methods: agent.send, agent.cancel, sessions.list, sessions.history,
sessions.create, tools.list, tools.invoke, system.health.

Auth: Bearer token + Tailscale identity header support.
Session bridge: per-connection agent instances with shared model router.

New files: src/gateway/ (protocol, router, server, auth, session-bridge,
handlers for agent/sessions/tools/system).
57 new tests (181 total), typecheck clean.

src/gateway/handlers/index.ts

@@ -0,0 +1,8 @@
+export { createSystemHandlers } from './system.js';
+export type { SystemHandlerDeps } from './system.js';
+export { createSessionHandlers } from './sessions.js';
+export type { SessionHandlerDeps } from './sessions.js';
+export { createToolHandlers } from './tools.js';
+export type { ToolHandlerDeps } from './tools.js';
+export { createAgentHandlers } from './agent.js';
+export type { AgentHandlerDeps } from './agent.js';