feat(gateway): add WebSocket gateway with JSON-RPC protocol and auth

Phase 2 of the Flynn roadmap. Adds a WebSocket gateway server that
starts alongside the Telegram bot, providing real-time API access to
the agent, sessions, and tools.

Protocol: JSON-RPC-like (request/response/event) over WebSocket.
8 methods: agent.send, agent.cancel, sessions.list, sessions.history,
sessions.create, tools.list, tools.invoke, system.health.

Auth: Bearer token + Tailscale identity header support.
Session bridge: per-connection agent instances with shared model router.

New files: src/gateway/ (protocol, router, server, auth, session-bridge,
handlers for agent/sessions/tools/system).
57 new tests (181 total), typecheck clean.

src/gateway/handlers/system.ts

@@ -0,0 +1,25 @@
+import type { GatewayRequest, OutboundMessage } from '../protocol.js';
+import { makeResponse } from '../protocol.js';
+
+export interface SystemHandlerDeps {
+  startTime: number;
+  version: string;
+  getSessionCount: () => number;
+  getToolCount: () => number;
+  getConnectionCount: () => number;
+}
+
+export function createSystemHandlers(deps: SystemHandlerDeps) {
+  return {
+    'system.health': async (request: GatewayRequest): Promise<OutboundMessage> => {
+      return makeResponse(request.id, {
+        status: 'ok',
+        uptime: Math.floor((Date.now() - deps.startTime) / 1000),
+        version: deps.version,
+        sessions: deps.getSessionCount(),
+        tools: deps.getToolCount(),
+        connections: deps.getConnectionCount(),
+      });
+    },
+  };
+}