feat(dashboard): add conversations browser and API

[hanzckernel]

Summary

Adds a focused dashboard Conversations browser for cleaned local history.

This PR includes:

• Backend conversation APIs:
  • GET /api/conversations
  • GET /api/conversations/{conversation_id}/messages
  • DELETE /api/conversations/{conversation_id}
• A new dashboard Conversations page with:
  • conversation list
  • source filter
  • simple local search
  • transcript viewer
  • mobile-friendly list/detail behavior
  • delete action with confirmation and in-flight disable state
• TypeScript API bindings and i18n strings
• Regression tests for compression continuations, branch visibility, deletion/orphan behavior, pagination, search, and 404 behavior

Why

Earlier conversations-browser work lived in a broader prototype stack. This PR restacks the useful part onto main as a smaller dashboard-focused change, without pulling in unrelated chat transport or shell changes.

Related prototype context: #9903

Implementation notes

The backend implementation lives in hermes_cli/dashboard_conversations.py, with thin FastAPI wrappers in hermes_cli/web_server.py.

The display model reconstructs clean conversations from existing session data. It hides internal/system/probe artifacts, handles compression continuations, and keeps visible branches separately addressable.

Important limitations and guardrails:

• Conversation lineage is inferred from existing session metadata. This is covered by regression tests, but it is still heuristic rather than an explicit schema-level relationship.
• Search is simple local substring matching over conversation metadata plus visible transcript text; it is not ranked or FTS-backed conversation search.
• Pagination bounds are now validated at the HTTP layer and defensively normalized in the backend helper.
• Delete is intentionally destructive for the selected display conversation chain; the UI now requires confirmation and disables interactions while deletion is in flight.

Validation

Backend:

scripts/run_tests.sh tests/hermes_cli/test_dashboard_conversations.py --tb=short
python -m py_compile hermes_cli/dashboard_conversations.py hermes_cli/web_server.py tests/hermes_cli/test_dashboard_conversations.py

Frontend:

cd web
npm run build
npx eslint src/pages/ConversationsPage.tsx src/lib/api.ts src/i18n/types.ts src/i18n/en.ts src/i18n/zh.ts

Manual dashboard smoke:

export HERMES_HOME="$(mktemp -d)"
python -m hermes_cli.main dashboard --no-open --port 9129

Then open the dashboard and verify:

• Conversations page appears in navigation
• Conversation list loads
• Source filter works
• Search works
• Selecting a conversation loads messages
• Empty, loading, and error states render acceptably
• Deleting a disposable conversation updates the list and does not remove preserved branches

Authenticated API smoke against disposable local data:

curl -H "Authorization: Bearer $HERMES_SESSION_TOKEN" \
  "http://127.0.0.1:9129/api/conversations?limit=20"

curl -H "Authorization: Bearer $HERMES_SESSION_TOKEN" \
  "http://127.0.0.1:9129/api/conversations/<id>/messages"

curl -X DELETE -H "Authorization: Bearer $HERMES_SESSION_TOKEN" \
  "http://127.0.0.1:9129/api/conversations/<disposable-id>"

Notes:

• Frontend runtime behavior is currently validated by build/lint plus manual smoke; this PR does not add a dedicated web test harness.
• DELETE should only be smoke-tested against disposable local data.

Risk

Main risks:

1. Conversation lineage is heuristic.

   • A continuation could appear as a separate conversation.
   • A branch could be folded into a parent conversation.
   • Covered by regression tests, but future schema-level relationship metadata would be more robust.

2. Delete is destructive.

   • The backend deletes the selected display conversation chain and preserves visible descendants as orphaned conversations.
   • Reviewers should test DELETE only with disposable local data.

3. Performance is bounded for local use, but the current list implementation reconstructs and filters conversations before final pagination.

   • This should be acceptable for local dashboard usage.
   • Follow-up work should consider indexed search, cached previews, and stronger SQL-level pagination.

4. No intended changes to chat transport or existing chat UI.

Compatibility

• No database migration is introduced
• Existing sessions remain readable
• The feature uses existing session data and derives a cleaned dashboard view

Screenshots

Pending before ready-for-review:

• desktop Conversations page screenshot
• narrow/mobile Conversations page screenshot