Add the flow editor: canvas, node panel and live values

The browser half of M3. Flows open on a full-bleed canvas with their chrome
floating over it: flow tabs top, dock bottom, node settings in a panel on the
right that leaves the graph visible and running behind it.

- Connections are derived, not stored. A node declares the messages it reads
  and publishes; every matching pair draws an edge, so two producers of one
  message converge on their consumer. Dragging output to input is shorthand
  for pointing that input at the producer's message, and asks before it
  replaces an existing one.
- Values land on the edges as they flow, over a websocket that feeds a store
  outside React, so a value arriving re-renders its own chip and nothing else.
  Clicking an edge shows the last payload and when it arrived.
- Node source is edited in Monaco, loaded only when a panel opens and themed
  from the design tokens.
- Edits autosave; identical documents are skipped server-side, so a quiet
  canvas writes nothing.
- Validation from the API shows on the node it belongs to and is summarised in
  the dock, where each entry pans to its node.
- Works on a phone: touch-connect, 44px dock targets, and the node panel
  becomes a full-screen sheet.

Two new tokens (--status-success, --font-mono) are mirrored in the website repo
and recorded in DESIGN-GUIDELINES.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016WzrvW7rjQbynnhF6pxh6i

frontend/src/components/Flow/useFlowSocket.ts

@@ -0,0 +1,114 @@
+import { useEffect, useRef } from "react"
+
+import { OpenAPI } from "@/client"
+import { liveStore } from "./liveStore"
+
+const RECONNECT_MIN = 1000
+const RECONNECT_MAX = 30000
+
+type FlowEvent =
+  | {
+      type: "snapshot"
+      values: Record<string, { value: unknown; ts: number | null }>
+      nodes: { id: string; status: string; error?: string | null }[]
+    }
+  | { type: "message_value"; name: string; value: unknown; ts: number }
+  | { type: "node_executed"; node: string }
+  | { type: "node_error"; node: string; error: string }
+  | { type: "node_status"; node: string; status: string; error?: string | null }
+  | {
+      type: "pipeline_rebuilt"
+      nodes: { id: string; status: string; error?: string | null }[]
+    }
+
+function socketUrl(): string {
+  const base = String(OpenAPI.BASE || window.location.origin)
+  const url = new URL("/api/v1/flows/ws", base)
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:"
+  // Browsers cannot set headers on a websocket handshake, so the token rides
+  // in the query string.
+  url.searchParams.set("token", localStorage.getItem("access_token") ?? "")
+  return url.toString()
+}
+
+/**
+ * Keeps one socket open for the editor, feeding the live store.
+ *
+ * @param onAuthFailure called when the server rejects the token, so the caller
+ *   can send the user back to the login screen.
+ */
+export function useFlowSocket(onAuthFailure?: () => void): void {
+  const socket = useRef<WebSocket | null>(null)
+  const retry = useRef(RECONNECT_MIN)
+  const timer = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const closed = useRef(false)
+
+  useEffect(() => {
+    closed.current = false
+
+    const connect = () => {
+      if (closed.current) return
+      const ws = new WebSocket(socketUrl())
+      socket.current = ws
+
+      ws.onopen = () => {
+        retry.current = RECONNECT_MIN
+        liveStore.setConnected(true)
+      }
+
+      ws.onmessage = (event) => {
+        const message: FlowEvent = JSON.parse(event.data)
+        switch (message.type) {
+          case "snapshot":
+            liveStore.setValues(message.values)
+            liveStore.setStatuses(message.nodes)
+            break
+          case "message_value":
+            liveStore.setValue(message.name, {
+              value: message.value,
+              ts: message.ts,
+            })
+            break
+          case "node_executed":
+            liveStore.setStatus(message.node, { status: "success" })
+            break
+          case "node_error":
+            liveStore.setStatus(message.node, {
+              status: "error",
+              error: message.error,
+            })
+            break
+          case "node_status":
+            liveStore.setStatus(message.node, {
+              status: message.status as "active" | "error",
+              error: message.error,
+            })
+            break
+          case "pipeline_rebuilt":
+            liveStore.setStatuses(message.nodes)
+            break
+        }
+      }
+
+      ws.onclose = (event) => {
+        liveStore.setConnected(false)
+        if (closed.current) return
+        if (event.code === 1008) {
+          onAuthFailure?.()
+          return
+        }
+        timer.current = setTimeout(connect, retry.current)
+        retry.current = Math.min(retry.current * 2, RECONNECT_MAX)
+      }
+    }
+
+    connect()
+
+    return () => {
+      closed.current = true
+      if (timer.current) clearTimeout(timer.current)
+      socket.current?.close()
+      liveStore.setConnected(false)
+    }
+  }, [onAuthFailure])
+}