feat(dashboard): web chat client self-declares source='dashboard'

[Kyzcreig]

Problem

The in-browser web dashboard chat (web/), the Electron desktop app, and the Ink TUI all drive the same tui_gateway JSON-RPC server, which stamps platform='tui' by default. PR #175 taught the Electron app + backend to thread a client source so turns are attributed per-client (desktop/dashboard/mobile) on tokens.ace — but the web dashboard client (web/src/lib/gatewayClient.ts) was never updated. So turns from the browser dashboard chat still recorded as tui.

Ground-truthed live: the user chats via the web dashboard in a browser (not the Electron app); every one of those turns recorded platform='tui'.

Fix

Override GatewayClient.request to stamp source:'dashboard' on the session-originating methods (session.create/session.resume) when the caller hasn't set an explicit source — the sidebar sidecar session deliberately sends source:'tool', which is preserved. Mirrors the Electron app's requestGateway injection exactly. The backend already sanitizes + threads source → AIAgent(platform=...) (#175), so no backend change is needed.

Verification

• Typecheck clean; production build carries the injection (=\dashboard`,…=new Set(['session.create','session.resume'])`).
• Unit test web/src/lib/gatewayClient.test.ts (4): stamps create/resume, skips non-session-originating methods (prompt.submit), never overrides an explicit source.
• Live E2E (self-service, no browser): drove the real dashboard WS path — password-login → ws-ticket → /api/ws → session.create(source='dashboard') → prompt.submit → confirmed the blackbox recorded platform='dashboard'. tokens.ace "Token sources by day" now shows dashboard + desktop as distinct sources.

[greptile-apps]

Greptile Summary

This PR tags browser dashboard chat sessions with a dashboard source. The main changes are:

• Adds source injection for session.create and session.resume gateway calls.
• Preserves caller-provided sources such as the sidebar tool session.
• Adds unit tests for stamped, unstamped, and explicitly sourced requests.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
web/src/lib/gatewayClient.ts	Adds dashboard source tagging for session-originating gateway requests while preserving explicit caller sources.
web/src/lib/gatewayClient.test.ts	Adds tests for dashboard source tagging, skipped non-session calls, and explicit source preservation.

_{Reviews (3): Last reviewed commit: "ci: re-trigger checks (apps/desktop/node..." | Re-trigger Greptile}