feat(grpc): dev mode, agent prefix, system prompt, error UX

- gRPC dev_mode config: disables JWT auth, uses fixed dev identity
- Agent prefix (agents.agent_prefix): dev agents use "dev-sol-orchestrator"
  to avoid colliding with production on shared Mistral accounts
- Coding sessions use instructions (system prompt + coding addendum)
  with mistral-medium-latest for personality adherence
- Conversations API: don't send both model + agent_id (422 fix)
- GrpcState carries system_prompt + orchestrator_agent_id
- Session.end() keeps session active for reuse (not "ended")
- User messages posted as m.notice, assistant as m.text (role detection)
- History loaded from Matrix room on session resume
- Docker Compose local dev stack: OpenSearch 3 + Tuwunel + SearXNG
- Dev config: localhost URLs, dev_mode, opensearch-init.sh for ML setup

docker-compose.dev.yaml

@@ -0,0 +1,53 @@
+## Local dev stack for sunbeam code iteration.
+## Run: docker compose -f docker-compose.dev.yaml up
+## Sol gRPC on localhost:50051, Matrix on localhost:8008
+
+services:
+  opensearch:
+    image: opensearchproject/opensearch:3
+    environment:
+      - discovery.type=single-node
+      - OPENSEARCH_JAVA_OPTS=-Xms1536m -Xmx1536m
+      - DISABLE_SECURITY_PLUGIN=true
+      - plugins.ml_commons.only_run_on_ml_node=false
+      - plugins.ml_commons.native_memory_threshold=90
+      - plugins.ml_commons.model_access_control_enabled=false
+      - plugins.ml_commons.allow_registering_model_via_url=true
+    ports:
+      - "9200:9200"
+    volumes:
+      - opensearch-data:/usr/share/opensearch/data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://localhost:9200/_cluster/health || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+
+  tuwunel:
+    image: jevolk/tuwunel:main
+    environment:
+      - CONDUWUIT_SERVER_NAME=sunbeam.local
+      - CONDUWUIT_DATABASE_PATH=/data
+      - CONDUWUIT_PORT=8008
+      - CONDUWUIT_ADDRESS=0.0.0.0
+      - CONDUWUIT_ALLOW_REGISTRATION=true
+      - CONDUWUIT_ALLOW_GUEST_REGISTRATION=true
+      - CONDUWUIT_YES_I_AM_VERY_VERY_SURE_I_WANT_AN_OPEN_REGISTRATION_SERVER_PRONE_TO_ABUSE=true
+      - CONDUWUIT_LOG=info
+    ports:
+      - "8008:8008"
+    volumes:
+      - tuwunel-data:/data
+
+  searxng:
+    image: searxng/searxng:latest
+    environment:
+      - SEARXNG_SECRET=dev-secret-key
+    ports:
+      - "8888:8080"
+    volumes:
+      - ./dev/searxng-settings.yml:/etc/searxng/settings.yml:ro
+
+volumes:
+  opensearch-data:
+  tuwunel-data: