studio: agent window, a chat with a model that edits the scene

✦ Agent in the Studio's top bar opens a floating chat window. The model
(any OpenAI-compatible endpoint with tool calling; default B4L's inference
server, https://inference.p0.contact/v1) gets the 15 MCP tools plus two page
tools (select_object, set_view) and the Studio's state (selection, level,
rotation) in its system prompt. Answers and reasoning stream in; tool calls
show as rows with arguments and results; object ids link to the object;
Stop ends a turn; Undo takes the agent's edits back. The window moves by
its title bar and resizes at its top-left corner.

- studio/agent.js: shared by both front ends (waits for studio.js's
  isokit:studio event); MCP over /mcp or isokit.mcp in the web Studio
- isokit studio: /api/agent/{config,models,chat} relay the calls on their
  own threads (ureq, chunked and flushed per read), so the key stays on the
  machine and the endpoint needs no CORS; settings from ISOKIT_LLM_URL /
  _KEY / _MODEL or agent.json in the user's config folder
- web Studio: calls the endpoint from the page with a key kept in the
  browser; build_web.py --agent-url names a same-site relay as default; the
  deploy builds with /llm/v1, which deploy/Caddyfile forwards to the
  inference server (its nginx refuses the CORS preflight)
- tools/mock_llm.py + tools/agent_checks.py: the agent window checks in both
  check_studio.py and check_web.py

deploy/Caddyfile

@@ -14,12 +14,30 @@ isokit.buildfor.life {
 	header X-Frame-Options "SAMEORIGIN"
 	# Testing deployment: keep it out of search engines.
 	header X-Robots-Tag "noindex, nofollow"
-	# Revalidate everything: isokit_wasm.js and its .wasm load without a
-	# version query, and a stale copy at Cloudflare would not match the
-	# new glue code after a deploy. Unchanged files still come back as 304.
-	header Cache-Control "no-cache"
 
-	root * /var/www/isokit.buildfor.life
-	encode zstd gzip
-	file_server
+	# The agent window's relay to B4L's inference server (the build's
+	# default endpoint, build_web.py --agent-url /llm/v1). Same site, so the
+	# page needs no CORS from the endpoint, whose nginx answers the CORS
+	# preflight with 401. The relay adds no key: the page sends the one its
+	# user entered, so only key holders get answers. flush_interval -1 passes
+	# the streamed tokens on as they come.
+	handle_path /llm/* {
+		reverse_proxy https://inference.p0.contact {
+			header_up Host {upstream_hostport}
+			header_up -Cookie
+			header_up -Origin
+			header_up -Referer
+			flush_interval -1
+		}
+	}
+
+	handle {
+		# Revalidate everything: isokit_wasm.js and its .wasm load without a
+		# version query, and a stale copy at Cloudflare would not match the
+		# new glue code after a deploy. Unchanged files still come back as 304.
+		header Cache-Control "no-cache"
+		root * /var/www/isokit.buildfor.life
+		encode zstd gzip
+		file_server
+	}
 }