fix(agent): Chat Agent 全链路 P0-P5 整改

封堵鉴权旁路与导出 IDOR，DocGov 改服务端身份；对话层 PendingAction 接真实 docgov/taskrun；修复流式租约假死与会话级任务流；加固配置/doc_id/NULL；补齐 slog 与测试；前端 ErrorBoundary 与受控文档重试。

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/api/taskStream.test.ts

@@ -63,6 +63,18 @@ test('buildResumeRequest: adds work_dir on top of task request', () => {
   assert.equal('add_steps' in req, false);
 });
 
+test('buildTaskRequest: canonicalizes legacy doc-p doc_id', () => {
+  const req = buildTaskRequest({
+    taskKey: 'research',
+    projectName: 'P',
+    customerName: 'C',
+    deviceType: 'D',
+    projectId: 56,
+    docId: 'doc-p56-research',
+  });
+  assert.equal(req.doc_id, 'doc_proj56_research');
+});
+
 test('buildResumeRequest: forwards add_steps when provided', () => {
   const req = buildResumeRequest(
     { taskKey: 'intake', projectName: 'P', customerName: 'C', deviceType: 'D' },