Anonymous access overhaul, trigger policy redesign, and chat reliability

Features

• Tools-as-code only path and anonymous access overhaul: Introduced a dedicated tools-as-code execution path and significantly reworked how anonymous access is granted and controlled across the platform.
• Agent trigger policies redesigned as optional context deltas: Trigger policies now act as lightweight, optional context deltas rather than rigid configurations, giving agents more flexible and composable activation behavior (AUX-169).
• Health check endpoint alias: Added GET /health as a top-level alias for GET /api/health to simplify load balancer and uptime monitor configuration.

Improvements

• Fail-fast on rate limit and API errors in chat: Chat jobs now immediately surface rate limit and API errors rather than retrying indefinitely, reducing unnecessary latency and resource usage (AUX-180).
• Sidebar navigation pinned on desktop and tablet: Profile, settings, logout, and collapse controls are now anchored to the bottom of the sidebar on desktop and tablet viewports.

Fixes

• Coordinator deduplication and direct-mention accuracy: Resolved issues with synthetic message deduplication, the reprompt loop firing incorrectly, and direct-mention detection producing false positives or misses in Slack.
• MCP aggregate bindings matched against anonymous allowlist paths: The coordinator now correctly evaluates MCP aggregate bindings when checking anonymous allowlist path rules.
• 404 returned for missing SPA static assets: The server now correctly responds with 404 for static asset requests that do not match a known file, rather than falling through to the SPA shell.

Internal

• Replaced raw DaisyUI alert classes with the AppInlineAlert component across the UI to ensure consistent styling compliance.