Add durable chat runs, shared agent runtime, reliable jobs, history tools and citations

Shared runtime
- One agent entry point (runtime.invoke_agent_for_user / prepare_agent_turn) for
  web, email, iMessage, WhatsApp, scheduled and cron, so identity, permissions,
  memories, summaries and metrics match across channels.
- Serialize turns per checkpoint thread; /query validates input and returns 409
  while a durable run owns the conversation.

Reconnectable chat (durable runs)
- POST /runs creates an idempotent, owner-scoped run; GET .../events replays an
  ordered SSE log by cursor, so generation survives refresh and device switches.
  Stop cancels; disconnect only detaches. /stream-query is a compatibility adapter.
- Coalesce streamed deltas (150 ms) and wake same-process subscribers instead of
  polling; keep buffered text when a run is stopped.
- Drain runs on shutdown; serve via Hypercorn with a shutdown timeout covering
  the drain (and no longer in debug mode). CHAT_RUN_* settings are forwarded.

Scheduled messages and cron
- Atomic delivery claims, attempt history and explicit retries; ambiguous sends
  become "uncertain" and are never resent automatically.
- Cron triggers need a run_id/Idempotency-Key; legacy jobs need an explicit owner.
- Cancelling never rewrites a started delivery; series stop via tombstones.
  Legacy sent rows are not forked into new series. Malformed bodies return 400.

History, integrations and retrieval
- Message-content search, pinned conversations, JSON/Markdown export and a
  memory editor.
- Integration status panel and YNAB data-freshness provenance.
- Date-filtered document/note search with stable citations and a source viewer.

Migration 20 is generated by aerich.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -41,6 +41,12 @@ TOOL_ROUTING_MODE=static
 # Optional durable summary sidecar; defaults to CHECKPOINT_DB_PATH + .summaries.db
 # Store on the same persistent shared volume as the checkpoints.
 # CONVERSATION_SUMMARY_DB_PATH=/app/checkpoints/conversation-summaries.db
+# Durable chat runs (see docs/chat-runs.md). Lease = abandoned-worker timeout;
+# max = whole generation; drain = shutdown wait for in-flight generations.
+# scripts/deploy.sh gives the old container drain + 60s (override DEPLOY_STOP_SECONDS).
+CHAT_RUN_LEASE_SECONDS=30
+CHAT_RUN_MAX_SECONDS=1800
+CHAT_RUN_DRAIN_SECONDS=1800
 
 # Embedding Server Configuration
 # If set, uses a custom OpenAI-compatible embedding server (e.g. llama-server)