feat: complete phase 1 -- core framework with chat loop, agents, and React UI

Backend:
- FastAPI WebSocket /ws endpoint with streaming via LangGraph astream
- LangGraph Supervisor connecting 3 mock agents (order_lookup, order_actions, fallback)
- YAML Agent Registry with Pydantic validation and immutable configs
- PostgresSaver checkpoint persistence via langgraph-checkpoint-postgres
- Session TTL with 30-min sliding window and interrupt extension
- LLM provider abstraction (Anthropic/OpenAI/Google)
- Token usage + cost tracking callback handler
- Input validation: message size cap, thread_id format, content length
- Security: no hardcoded defaults, startup API key validation, no input reflection

Frontend:
- React 19 + TypeScript + Vite chat UI
- WebSocket hook with reconnect + exponential backoff
- Streaming token display with agent attribution
- Interrupt approval/reject UI for write operations
- Collapsible tool call viewer

Testing:
- 87 unit tests, 87% coverage (exceeds 80% requirement)
- Ruff lint + format clean

Infrastructure:
- Docker Compose (PostgreSQL 16 + backend)
- pyproject.toml with full dependency management

backend/tests/unit/test_config.py

@@ -0,0 +1,60 @@
+"""Tests for app.config module."""
+
+from __future__ import annotations
+
+import pytest
+
+from app.config import Settings
+
+
+@pytest.mark.unit
+class TestSettings:
+    def test_default_values(self) -> None:
+        settings = Settings(
+            database_url="postgresql://x:x@localhost/db",
+            anthropic_api_key="key",
+        )
+        assert settings.llm_provider == "anthropic"
+        assert settings.llm_model == "claude-sonnet-4-6"
+        assert settings.session_ttl_minutes == 30
+        assert settings.interrupt_ttl_minutes == 30
+
+    def test_custom_values(self) -> None:
+        settings = Settings(
+            database_url="postgresql://x:x@localhost/db",
+            llm_provider="openai",
+            llm_model="gpt-4o",
+            session_ttl_minutes=15,
+            openai_api_key="sk-test",
+        )
+        assert settings.llm_provider == "openai"
+        assert settings.llm_model == "gpt-4o"
+        assert settings.session_ttl_minutes == 15
+
+    def test_invalid_provider_rejected(self) -> None:
+        with pytest.raises(Exception):
+            Settings(
+                database_url="postgresql://x:x@localhost/db",
+                llm_provider="invalid",
+            )
+
+    def test_missing_database_url_rejected(self) -> None:
+        with pytest.raises(Exception):
+            Settings(anthropic_api_key="key")
+
+    def test_empty_api_key_for_provider_rejected(self) -> None:
+        with pytest.raises(ValueError, match="API key"):
+            Settings(
+                database_url="postgresql://x:x@localhost/db",
+                llm_provider="anthropic",
+                anthropic_api_key="",
+            )
+
+    def test_wrong_provider_key_rejected(self) -> None:
+        with pytest.raises(ValueError, match="API key"):
+            Settings(
+                database_url="postgresql://x:x@localhost/db",
+                llm_provider="openai",
+                anthropic_api_key="key",
+                openai_api_key="",
+            )