feat(ai-chat): agent write tools, provenance wiring, chat panel + provider settings UI" -m "Backend:

- Add reversible write tools to the per-user agent toolset (page create/update/
  move/soft-delete; comment reply + resolve), exposed under the user's JWT and
  enforced by Docmost CASL; no permanent/force delete (D3).
- Non-spoofable agent provenance: sign actor/aiChatId into the access and collab
  tokens (TokenService), propagate via jwt.strategy onto the request, and set
  pages.last_updated_source/last_updated_ai_chat_id on REST create/update/move and
  comments.created_source/resolved_source/ai_chat_id.
- packages/mcp: add an optional getCollabToken provider (content-edit provenance)
  and guard against empty tokens; service-account /mcp path unchanged.

Frontend:
- Admin 'AI / Models' settings section: provider/model/embedding/base URL, a
  write-only API key field, system prompt, and Test connection.
- AI chat panel (useChat + DefaultChatTransport): conversation list, streamed
  messages, tool-call action log and page citations; header entry point gated on
  settings.ai.chat.

Compile-verified (server nest build + client tsc/vite); not yet live-tested.
Known gaps: history 'AI agent' badge (C3), vector RAG (D), external MCP (E);
chat tool-card citation links pending a fix.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/client/src/components/layouts/global/aside.tsx

@@ -9,6 +9,7 @@ import { TableOfContents } from "@/features/editor/components/table-of-contents/
 import { useAtomValue } from "jotai";
 import { pageEditorAtom } from "@/features/editor/atoms/editor-atoms.ts";
 import { PageDetailsAside } from "@/features/page-details/components/page-details-aside.tsx";
+import AiChatPanel from "@/features/ai-chat/components/ai-chat-panel.tsx";
 import { ASIDE_PANEL_ID } from "@/hooks/use-toggle-aside.tsx";
 
 export default function Aside() {
@@ -38,11 +39,26 @@ export default function Aside() {
       component = <PageDetailsAside />;
       title = "Details";
       break;
+    case "ai-chat":
+      // The AI chat panel renders its own header (title + new-chat + close) and
+      // manages its own scrolling, so it bypasses the shared Aside chrome below.
+      component = <AiChatPanel />;
+      title = "AI chat";
+      break;
     default:
       component = null;
       title = null;
   }
 
+  // The AI chat panel owns the full aside area (its own header + layout).
+  if (tab === "ai-chat") {
+    return (
+      <Box p="md" style={{ height: "100%", display: "flex", flexDirection: "column" }}>
+        {component}
+      </Box>
+    );
+  }
+
   return (
     <Box p="md" style={{ height: "100%", display: "flex", flexDirection: "column" }}>
       {component && (