feat(web): align Agents UI with the current Core contract

[sam2tom]

Summary

• align the product information architecture with an Agents-first workflow using Agents and Sessions navigation plus a global Create menu
• add a dedicated Agent Setup page for the generation fields supported by the current Core contract, with credential-safe JSON and curl previews
• restore the documented agents=v1 Session message, steering, cancellation, and function-result flow
• require exact HTTP 204 event admission, preserve uncertain payload/idempotency state for explicit unchanged manual retry, and never retry automatically
• hide the top-level Environments destination and template/key Create entries because Core exposes no public list or management APIs
• retain the exact read-only Environment and Workspace projection for an already selected self_hosted Session
• refresh the immutable Parsar compatibility audit to d91ba48

Core capability boundary

The Web uses only the documented /v1/agents/** and Session-events contract. HTTP health, Agent creation, SSE connectivity, model IDs, and prior Turns are not treated as execution-readiness proof. Runtime, model, provider, or credential failures remain explicit in durable Core state.

Environment list, template CRUD, file management, and browser-facing key management remain unsupported and are not advertised or simulated.

The live validation superseded the negative-write proposal in #24: absence of a separate readiness resource does not justify blocking the current documented Session-events contract.

Validation

• pnpm check (67 root tests, 50 agents-client tests, 344 Web tests, typecheck, and production build)
• pnpm test:acceptance (41/41 passed against the isolated fixture Core)
• GitHub check passed on the final combined head
• git diff --check
• real local Parsar d91ba48 flow: Web -> Agents API -> daemon -> Codex 0.153.4 -> provider -> assistant output, confirmed interactively; provider credentials remained server-side and were not committed

No Parsar source was modified. Nothing was deployed, and no branch or Worktree is deleted by this merge.

Closes #22
Supersedes #24