feat: complete phase 1 -- core framework with chat loop, agents, and React UI

Backend:
- FastAPI WebSocket /ws endpoint with streaming via LangGraph astream
- LangGraph Supervisor connecting 3 mock agents (order_lookup, order_actions, fallback)
- YAML Agent Registry with Pydantic validation and immutable configs
- PostgresSaver checkpoint persistence via langgraph-checkpoint-postgres
- Session TTL with 30-min sliding window and interrupt extension
- LLM provider abstraction (Anthropic/OpenAI/Google)
- Token usage + cost tracking callback handler
- Input validation: message size cap, thread_id format, content length
- Security: no hardcoded defaults, startup API key validation, no input reflection

Frontend:
- React 19 + TypeScript + Vite chat UI
- WebSocket hook with reconnect + exponential backoff
- Streaming token display with agent attribution
- Interrupt approval/reject UI for write operations
- Collapsible tool call viewer

Testing:
- 87 unit tests, 87% coverage (exceeds 80% requirement)
- Ruff lint + format clean

Infrastructure:
- Docker Compose (PostgreSQL 16 + backend)
- pyproject.toml with full dependency management

backend/app/agents/order_actions.py

@@ -0,0 +1,37 @@
+"""Order action tools -- write operations requiring human approval."""
+
+from __future__ import annotations
+
+from langchain_core.tools import tool
+from langgraph.types import interrupt
+
+
+@tool
+def cancel_order(order_id: str) -> dict:
+    """Cancel an order. Requires human approval before execution."""
+    response = interrupt(
+        {
+            "action": "cancel_order",
+            "order_id": order_id,
+            "message": f"Please confirm: cancel order {order_id}?",
+        }
+    )
+
+    if isinstance(response, bool):
+        approved = response
+    elif isinstance(response, dict):
+        approved = response.get("approved", False)
+    else:
+        approved = bool(response)
+
+    if approved:
+        return {
+            "status": "cancelled",
+            "order_id": order_id,
+            "message": f"Order {order_id} has been successfully cancelled.",
+        }
+    return {
+        "status": "kept",
+        "order_id": order_id,
+        "message": f"Order {order_id} cancellation was declined. The order remains active.",
+    }