feat(cli): interactive orva chat, orva docs, themed color + dynamic completion

[Harsh-2002]

Summary

Makes the slim orva CLI do nearly what the dashboard does, with Orva-themed output that works on any terminal.

• Theming (cli/commands/theme): lipgloss palette (pure-Go, auto truecolor→256→16, light/dark adaptive). theme.New(enabled) no-ops when color is off, gated by the existing --no-color/NO_COLOR/TTY chain. okf() + diff colorizer route through it. Table bodies stay uncolored (ANSI breaks tabwriter).
• orva chat: interactive streaming REPL + one-shot (-p, @file/@-) over the AI SSE backend with the CLI's API key. Live token streaming → glamour markdown re-render on a TTY (guarded; --raw/ORVA_CHAT_NO_GLAMOUR escape hatches). Thinking + tool status to stderr, answer to stdout. Approval respects the server policy: [y/N] interactively, fail-closed non-interactively, opt-in --auto-approve//yolo (-y not honored for AI approvals). /help /model /thinking /new /clear /yolo /exit; selection persists via PUT /ai/selection. Ctrl-C aborts the turn (not the process) via a new client.Request.Ctx.
• orva docs: renders embedded docs/reference.md via glamour + $PAGER, --raw, origin substitution. make docs-embed now syncs the CLI copy.
• Completions + help: dynamic completion for function names, runtimes, chat models, -o/--thinking enums; grouped orva --help.

Validation

• go test ./..., go vet ./... green; command-tree golden diff matches.
• Cross-build matrix (6 targets, formats + sizes) 19/0 — size ceiling raised to 28 MB (glamour/chroma is a deliberate ~8 MB add; slim binary 12→20 MB).
• Isolated e2e (test/e2e, fresh container, mock LLM): all modules green incl. test_cli (39/0) and new test_cli_chat (11/0); deploy_invoke skips (no nsjail in-container, expected).
• Live-verified against the dev instance: REPL turn (banner/thinking/tool lines/glamour answer), interactive approval reject (no mutation), fail-closed when piped, /model picker, --no-color.

Notes

• New deps: charmbracelet/lipgloss + glamour (pure-Go, no CGO).
• No backend/frontend behavior changes — CLI + shared internal/client + Makefile/tests only.

[Harsh-2002]

Review (complete) — merge-ready

Adversarial review across correctness, security, regressions, and resource handling. No blockers / no highs. Verified correct:

• SSE drive() — all events handled; every terminal event returns stop; clean-EOF-without-terminal degrades gracefully (no hang).
• Approval worklist — traced against the server protocol (agent.go Resume/hasPendingForMessage): no double-prompt, no double-POST, no skipped tool, no infinite loop. Fail-closed when stdin isn't a TTY and --auto-approve is off; global -y correctly not consulted for AI approval.
• Resource leaks — all *http.Response bodies closed on every path (incl. non-2xx via checkResponse); no double-close.
• Ctrl-C — per-turn signal lifecycle, no goroutine/handler leak; cancel aborts the in-flight request, not the process.
• Color gating — routes through the existing --no-color/NO_COLOR/JSON/TTY chain; no ANSI in non-TTY or tabwriter.
• Completions — failures swallowed (never error the shell); first-positional-only for function names.
• One-shot — clean stdout (banner/thinking/tools to stderr); error SSE frame → non-zero exit.

Fixes applied (commit 294f54d)

• MEDIUM — completion HTTP calls used the 120s client timeout, so an unreachable endpoint could stall the shell during tab-completion; now bounded to 2s.
• NIT — removed the unused theme.Header style.

LOW/NIT remainder accepted as-is (approval prompt shows truncated tool args on the operator's own terminal — matches the dashboard; pre-existing single-line SSE data: handling).

Validation

go test ./... + go vet green; command-tree golden diff matches; cross-build matrix 19/0; isolated e2e all modules green incl. test_cli (39/0) and new test_cli_chat (11/0). CI + e2e + cli-e2e green on 477112e; re-running on 294f54d.