refactor: fix architectural issues across frontend and backend

Address all architecture review findings:

P0 fixes:
- Add API key authentication for admin endpoints (analytics, replay, openapi)
  and WebSocket connections via ADMIN_API_KEY env var
- Add PostgreSQL-backed PgSessionManager and PgInterruptManager for
  multi-worker production deployments (in-memory defaults preserved)

P1 fixes:
- Implement actual tool generation in OpenAPI approve_job endpoint
  using generate_tool_code() and generate_agent_yaml()
- Add missing clarification, interrupt_expired, and tool_result message
  handlers in frontend ChatPage

P2 fixes:
- Replace monkey-patching on CompiledStateGraph with typed GraphContext
- Replace 9-param dispatch_message with WebSocketContext dataclass
- Extract duplicate _envelope() into shared app/api_utils.py
- Replace mutable module-level counter with crypto.randomUUID()
- Remove hardcoded mock data from ReviewPage, use api.ts wrappers
- Remove `as any` type escape from ReplayPage

All 516 tests passing, 0 TypeScript errors.

backend/app/graph.py

@@ -9,13 +9,13 @@ from langchain.agents import create_agent
 from langgraph_supervisor import create_supervisor
 
 from app.agents import get_tools_by_names
+from app.graph_context import GraphContext
 
 if TYPE_CHECKING:
     from langchain_core.language_models import BaseChatModel
     from langgraph.checkpoint.postgres.aio import AsyncPostgresSaver
-    from langgraph.graph.state import CompiledStateGraph
 
-    from app.intent import ClassificationResult, IntentClassifier
+    from app.intent import IntentClassifier
     from app.registry import AgentRegistry
 
 logger = logging.getLogger(__name__)
@@ -75,12 +75,11 @@ def build_graph(
     llm: BaseChatModel,
     checkpointer: AsyncPostgresSaver,
     intent_classifier: IntentClassifier | None = None,
-) -> CompiledStateGraph:
+) -> GraphContext:
     """Build and compile the LangGraph supervisor graph.
 
-    If an intent_classifier is provided, the supervisor prompt is enhanced
-    with agent descriptions for better routing. The classifier is stored
-    for use by the routing layer (ws_handler).
+    Returns a GraphContext that bundles the compiled graph with its
+    associated registry and intent classifier.
     """
     agent_nodes = build_agent_nodes(registry, llm)
     agent_descriptions = _format_agent_descriptions(registry)
@@ -94,28 +93,10 @@ def build_graph(
         output_mode="full_history",
     )
 
-    graph = workflow.compile(checkpointer=checkpointer)
+    compiled = workflow.compile(checkpointer=checkpointer)
 
-    # Attach classifier and registry to graph for use by ws_handler
-    graph.intent_classifier = intent_classifier  # type: ignore[attr-defined]
-    graph.agent_registry = registry  # type: ignore[attr-defined]
-
-    return graph
-
-
-async def classify_intent(
-    graph: CompiledStateGraph,
-    message: str,
-) -> ClassificationResult | None:
-    """Classify user intent using the graph's attached classifier.
-
-    Returns None if no classifier is configured.
-    """
-    classifier = getattr(graph, "intent_classifier", None)
-    registry = getattr(graph, "agent_registry", None)
-
-    if classifier is None or registry is None:
-        return None
-
-    agents = registry.list_agents()
-    return await classifier.classify(message, agents)
+    return GraphContext(
+        graph=compiled,
+        registry=registry,
+        intent_classifier=intent_classifier,
+    )