feat(gateway): add WebSocket gateway with JSON-RPC protocol and auth

Phase 2 of the Flynn roadmap. Adds a WebSocket gateway server that
starts alongside the Telegram bot, providing real-time API access to
the agent, sessions, and tools.

Protocol: JSON-RPC-like (request/response/event) over WebSocket.
8 methods: agent.send, agent.cancel, sessions.list, sessions.history,
sessions.create, tools.list, tools.invoke, system.health.

Auth: Bearer token + Tailscale identity header support.
Session bridge: per-connection agent instances with shared model router.

New files: src/gateway/ (protocol, router, server, auth, session-bridge,
handlers for agent/sessions/tools/system).
57 new tests (181 total), typecheck clean.

src/gateway/index.ts

@@ -0,0 +1,29 @@
+export { GatewayServer } from './server.js';
+export type { GatewayServerConfig } from './server.js';
+export { Router } from './router.js';
+export type { HandlerFn, SendFn } from './router.js';
+export { SessionBridge } from './session-bridge.js';
+export type { SessionBridgeConfig } from './session-bridge.js';
+export { authenticateRequest } from './auth.js';
+export type { AuthConfig, AuthResult } from './auth.js';
+export {
+  ErrorCode,
+  isValidRequest,
+  parseMessage,
+  makeResponse,
+  makeError,
+  makeEvent,
+} from './protocol.js';
+export type {
+  GatewayRequest,
+  GatewayResponse,
+  GatewayError,
+  GatewayEvent,
+  OutboundMessage,
+  EventType,
+  ContentEventData,
+  ToolStartEventData,
+  ToolEndEventData,
+  DoneEventData,
+  ErrorEventData,
+} from './protocol.js';