feat: complete phase 5 -- error hardening, frontend, Docker, demo, docs

Backend:
- ConversationTracker: Protocol + PostgresConversationTracker for lifecycle tracking
- Error handler: ErrorCategory enum, classify_error(), with_retry() exponential backoff
- Wire PostgresAnalyticsRecorder + ConversationTracker into ws_handler
- Rate limiting (10 msg/10s per thread), edge case hardening
- Health endpoint GET /api/health, version 0.5.0
- Demo seed data script + sample OpenAPI spec

Frontend (all new):
- React Router with NavBar (Chat / Replay / Dashboard / Review)
- ReplayListPage + ReplayPage with ReplayTimeline component
- DashboardPage with MetricCard, range selector, zero-state
- ReviewPage for OpenAPI classification review
- ErrorBanner for WebSocket disconnect handling
- API client (api.ts) with typed fetch wrappers

Infrastructure:
- Frontend Dockerfile (multi-stage node -> nginx)
- nginx.conf with SPA routing + API/WS proxy
- docker-compose.yml with frontend service + healthchecks
- .env.example files (root + backend)

Documentation:
- README.md with quick start and architecture
- Agent configuration guide
- OpenAPI import guide
- Deployment guide
- Demo script

48 new tests, 449 total passing, 92.87% coverage

backend/tests/unit/test_ws_handler.py

@@ -138,7 +138,7 @@ class TestDispatchMessage:
         sm = SessionManager()
         cb = TokenUsageCallbackHandler()
 
-        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "x" * 9000})
+        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "x" * 10001})
         await dispatch_message(ws, graph, sm, cb, msg)
         call_data = ws.send_json.call_args[0][0]
         assert call_data["type"] == "error"
@@ -364,3 +364,80 @@ class TestInterruptHelpers:
         state.tasks = ()
         data = _extract_interrupt(state)
         assert data["action"] == "unknown"
+
+
+@pytest.mark.unit
+class TestDispatchMessageWithTracking:
+    @pytest.mark.asyncio
+    async def test_conversation_tracker_called_on_message(self) -> None:
+        ws = _make_ws()
+        graph = _make_graph()
+        sm = SessionManager()
+        cb = TokenUsageCallbackHandler()
+        tracker = AsyncMock()
+        pool = MagicMock()
+
+        sm.touch("t1")
+        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "hello"})
+        await dispatch_message(
+            ws, graph, sm, cb, msg,
+            conversation_tracker=tracker,
+            pool=pool,
+        )
+
+        tracker.ensure_conversation.assert_awaited_once_with(pool, "t1")
+        tracker.record_turn.assert_awaited_once()
+
+    @pytest.mark.asyncio
+    async def test_analytics_recorder_called_on_message(self) -> None:
+        ws = _make_ws()
+        graph = _make_graph()
+        sm = SessionManager()
+        cb = TokenUsageCallbackHandler()
+        recorder = AsyncMock()
+        pool = MagicMock()
+
+        sm.touch("t1")
+        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "hello"})
+        await dispatch_message(
+            ws, graph, sm, cb, msg,
+            analytics_recorder=recorder,
+            pool=pool,
+        )
+
+        recorder.record.assert_awaited_once()
+
+    @pytest.mark.asyncio
+    async def test_tracker_failure_does_not_break_chat(self) -> None:
+        ws = _make_ws()
+        graph = _make_graph()
+        sm = SessionManager()
+        cb = TokenUsageCallbackHandler()
+        tracker = AsyncMock()
+        tracker.ensure_conversation.side_effect = RuntimeError("DB down")
+        pool = MagicMock()
+
+        sm.touch("t1")
+        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "hello"})
+        # Should not raise despite tracker failure
+        await dispatch_message(
+            ws, graph, sm, cb, msg,
+            conversation_tracker=tracker,
+            pool=pool,
+        )
+        last_call = ws.send_json.call_args[0][0]
+        assert last_call["type"] == "message_complete"
+
+    @pytest.mark.asyncio
+    async def test_no_tracker_no_error(self) -> None:
+        ws = _make_ws()
+        graph = _make_graph()
+        sm = SessionManager()
+        cb = TokenUsageCallbackHandler()
+
+        sm.touch("t1")
+        msg = json.dumps({"type": "message", "thread_id": "t1", "content": "hello"})
+        # No tracker or recorder passed -- should work fine
+        await dispatch_message(ws, graph, sm, cb, msg)
+        last_call = ws.send_json.call_args[0][0]
+        assert last_call["type"] == "message_complete"