refactor(chat): move the turn lifecycle into a Main-process ChatStreamManager

[mrsibe]

Closes #140. Part of the chat execution epic, #138 — #144 made the semantics correct; this makes them live in one owner.

What was still wrong

The live state of every running turn was:

const activeStreams = new Map<string, AbortController>()

plus a handful of local variables in send-message — the accumulated text, the reasoning, the usage, the settled outcome — and four closures (settle, finishTurn, accountTurnTokens, announceOutcome) that existed only for the duration of one call. Nothing could answer what is this turn doing, nothing was reachable after the handler returned, and every feature on the roadmap (a timeout, a retry, attach and replay, the renderer overlay) would have had to add one more closure to the same function.

What this introduces

Role	What it is
The turn's state and rules	ChatExecution — src/main/services/chat/ChatExecution.ts: accumulated answer, the provider's reason and usage, and the one terminal outcome
The registry and lifecycle	ChatStreamManager — src/main/services/chat/ChatStreamManager.ts: one entry per running turn, and the only place a turn is settled, persisted and announced
Persistence port	ChatTurnStore, declared by the manager and implemented by services/chat/turnStore.ts over db/queries

chatHandlers.ts loses 260 lines: it assembles the prompt (user message, history, RAG, provenance) and hands the turn over. Every ending goes through one path in the manager — a stop the renderer asked for, a stream that failed or finished or just broke, and a turn that could not start at all (no prompt, no chat model).

Three things are deliberate:

• The manager imports neither db/queries nor Electron. It writes through the store port and reports through an emit callback supplied per turn. That is what lets test/chatStreamManager.test.ts drive a complete turn — chunks in, one persisted record out — with no database and no Electron process. For the same reason estimateTokens moved from SessionAutoSwitchService to shared/utils/tokenEstimate.ts: it is a pure function, and it was only unreachable outside Electron because it lived on a class that needs a database.
• abort settles before it cancels. The AbortError the SDK returns afterwards is noise after a decision instead of a second opinion about it — the invariant the issue asked for, now pinned by a test.
• A finished turn is removed from the registry before the renderer is told, so a late signal cannot find it and cannot start a second life for it.

The events forwarded to the renderer are unchanged, in the same shapes and the same order: changing that protocol is #141's job, and this PR must not.

Deferred, deliberately

seq and the subscriber/attach API. A sequence number nobody reads is structure without a consumer; #141's envelope is where it gets one, and the buffer that would hold replayed events exists for the same consumer. The issue's checklist is updated to say so rather than leaving two boxes unticked and unexplained.

Not in this PR either, per the issue: the chunk-stream protocol (#141), the renderer overlay (#142), retries, Continue, and the output-ceiling UI.

Behaviour notes

• A failed or aborted turn now stores the grounded citation subset rather than the whole evidence list — the same [Feat] Resolve and validate citations; never render an ungrounded [n] #70 rule delivered answers already had, applied to a partial answer whose markers still point at the passages it quoted.
• A turn that cannot start now writes its provenance before failing (the base metadata is written when the turn opens).

Verification

npm test	306 pass, 0 fail — 9 new in test/chatStreamManager.test.ts
npm run typecheck	clean (node, web, test)
npm run check:design	no violations
npm run build:unpack + smoke:packaged	PASS — 23 checks
npx eslint <changed files>	0 errors; the 2 no-explicit-any warnings in chatHandlers.ts are pre-existing lines

The new tests drive the real manager through the real ModelClient with a scripted provider from ai/test, including an abortable stream that errors on the signal the way a real transport does. They cover the issue's acceptance directly:

• a completed turn is persisted once, and the log proves the write happened before the finish event
• pending → streaming on the first chunk
• length completes as truncated and is not reported as an error
• an in-stream error keeps the partial answer and reports a failure
• a stop is recorded before it is acted on, and the AbortError that follows cannot re-label the turn
• a stop arriving after the answer is complete is refused (abort() returns false) and does not re-label it
• two turns in one notebook do not touch each other
• a turn that cannot start is still a turn with an outcome, and leaves nothing in the registry
• token accounting runs for every ending and never decides one

docs/architecture.md gains the seam and its invariants, next to the existing module-seam tables.