fix(provenance): address #143 re-review — shared resolver + decoupled badge

Architecture & design:
- Arch A: introduce resolveProvenance() as the single source of truth for
  deriving a write's actor/aiChatId from the SIGNED identity, and wire it into
  BOTH transport seams — the REST jwt.strategy and the collab
  authentication.extension. Previously the collab seam derived actor from the
  token claim alone and ignored user.isAgent, so a flagged service account's
  page-content edits over the websocket persisted as lastUpdatedSource='user',
  drifting from REST. The seams now share one resolver and can't diverge.
- Arch B: drop AiAgentBadge's page-history coupling. The generic ui/ badge no
  longer imports historyAtoms; it exposes an onActivate callback fired after the
  deep-link, and the history row passes onActivate to close its own modal.

Suggestions/warnings:
- S1: soften the jwt.strategy provenance comment (applies to every REST write).
- S2/suggestion-3: drop the redundant comment-list-item null-aiChatId test
  (covered by ai-agent-badge.test.tsx).
- S3: de-duplicate jwt.strategy.spec test #3 (the no-claim→'user' half
  duplicated test #2); keep only the signed actor='agent' claim assertion.
- W2: add keyboard-activation tests for the badge (Enter/Space, unrelated key).
- W3: flip the design doc status to "реализовано (#143)".

Tests:
- new auth-provenance.decorator.spec.ts unit-tests resolveProvenance +
  agentSourceFields.
- new collab-seam test: is_agent user with no claim → actor='agent'
  (Arch A regression guard).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/client/src/features/comment/components/comment-list-item.test.tsx

@@ -53,10 +53,7 @@ describe("CommentListItem — AI badge", () => {
     expect(screen.getByText("Service Bot")).toBeDefined();
   });
 
-  it("renders a non-clickable badge when aiChatId is null (external MCP agent)", () => {
-    renderItem(baseComment({ createdSource: "agent", aiChatId: null }));
-    expect(screen.getByText("AI-agent")).toBeDefined();
-    // No deep-link target → no interactive button role.
-    expect(screen.queryByRole("button")).toBeNull();
-  });
+  // The non-clickable (null aiChatId) branch is a property of AiAgentBadge itself
+  // and is covered in ai-agent-badge.test.tsx; this integration suite only needs
+  // the insertion gate (agent → badge, user → no badge) above (#143 review).
 });

apps/client/src/features/page-history/components/history-item.tsx

@@ -6,6 +6,8 @@ import classes from "./css/history.module.css";
 import clsx from "clsx";
 import { IPageHistory } from "@/features/page-history/types/page.types";
 import { memo, useCallback } from "react";
+import { useSetAtom } from "jotai";
+import { historyAtoms } from "@/features/page-history/atoms/history-atoms.ts";
 
 const MAX_VISIBLE_AVATARS = 5;
 
@@ -26,6 +28,8 @@ const HistoryItem = memo(function HistoryItem({
   onHoverEnd,
   isActive,
 }: HistoryItemProps) {
+  const setHistoryModalOpen = useSetAtom(historyAtoms);
+
   const handleClick = useCallback(() => {
     onSelect(historyItem.id, index);
   }, [onSelect, historyItem.id, index]);
@@ -99,6 +103,9 @@ const HistoryItem = memo(function HistoryItem({
           <AiAgentBadge
             authorName={historyItem.lastUpdatedBy?.name}
             aiChatId={historyItem.lastUpdatedAiChatId}
+            // The history row owns the modal: close it when the badge deep-links
+            // into the chat (the badge no longer reaches into page-history).
+            onActivate={() => setHistoryModalOpen(false)}
           />
         )}
       </Group>