feat(web): user auth + multi-user group chat with @mention

[floodsung]

Summary

Phase 1 of making the web platform fully replace Feishu as agent infrastructure.

• User registration & login: Self-service signup with username/password, SQLite-backed. First user gets admin role. Legacy API_SECRET still works.
• Multi-user group chat: Multiple humans + multiple agents in the same chat room. Messages without @ are human-to-human (broadcast to all). @botName routes to the specific agent.
• @mention autocomplete: Type @ in group chat InputBar to see a popup of available bots, select with keyboard or click.
• Group persistence: Groups now stored in SQLite (survive server restarts).
• User identity on WebSocket: Each connection carries user info (id, username, role, avatarColor).

Key files

Area	Files
User auth	src/auth/user-store.ts, src/api/routes/auth-routes.ts
Group chat	src/web/group-manager.ts, src/web/ws-server.ts
Frontend auth	web/src/components/LoginPage.tsx
@mention	web/src/components/chat/InputBar.tsx
Group header	web/src/components/ChatView.tsx, ChatView.module.css
WS protocol	web/src/hooks/useWebSocket.ts, web/src/types.ts

Test plan

• Register a new user → get token → auto-login
• Login with existing username/password
• Legacy API token still works
• Create group chat with 2+ bots → group persists after restart
• Type @ in group chat → autocomplete popup appears
• Select bot → @botName inserted → send → bot responds
• Send message without @ → broadcast to other users (no agent triggered)
• Group header shows group name + bot member chips
• npm run build + npm test + npm run lint pass

🤖 Generated with Claude Code