feat(dogfood-wave1): fix Studio retries, Chat error, LLM gateway, kill snapshot, topbar cleanup

User dogfood found many bugs. This wave addresses:

- nginx.conf: proxy_next_upstream + retries on 502/503/504, explicit
  proxy_ssl_name, 8s connect timeout. The DNS-resolver race that
  caused the Studio 'apply_patch 502' is now eaten by nginx retry.

- src/lib/wizardApi.ts: applyBatch retries 3x on 502/503/504 with
  exponential backoff. Even if nginx misses the retry the client
  takes a second shot.

- src/lib/chatApi.ts: listThreads now THROWS when ensureInbox fails
  instead of silently returning []. Chat scene shows the error +
  retry button instead of an empty 'No conversations' state that
  hides the real failure.

- src/scenes/Chat.tsx: explicit error banner with 'Try again' button.

- src/lib/llmClient.ts: rewritten to call /api/v1/llm/generate
  (real demo gateway, same as dev.flow-master.ai uses). Removed the
  local /internal/canvas-llm/chat sidecar entirely.

- src/scenes/Agent.tsx: removed the LLM-state probe + 'off by
  default' OFF pill. LLM is now part of the assistant unconditionally.

- src/lib/flowCuration.ts: dropped the STARTABLE_FLOW_KEYS allowlist
  gate in curatedPublishedFlows so list_processes now returns every
  published business process, not just pr_to_po_def.

- src/state/store.ts + tests: DataMode is now 'live' only. Removed
  the SNAPSHOT branch; live is the only mode. Renamed the failure
  toast accordingly. Initial scene is 'mission' not 'landing'.

- src/scenes/Login.tsx + test: post-login navigates to 'mission'
  instead of the empty landing splash.

- src/scenes/Settings.tsx + src/components/CommandBar.tsx: removed
  every snapshot/setMode reference. Settings shows 'EA2 · live
  always'. Command palette no longer offers a snapshot switch.

- src/App.tsx: topbar redesign. Removed Settings + Home tabs
  (now in user menu), removed standalone Light/Dark + Console
  buttons (collapsed into user menu), removed the SNAPSHOT/LIVE
  mode pill + topbar refresh. New UserMenu component shows a 2-char
  avatar circle; clicking opens a dropdown with Home / Settings /
  Refresh data / theme toggle / API console toggle. Topbar now has:
  brand · tabs · cmd-k · notification bell · avatar.

- src/index.css: user-menu styles + chat-err styles + dark variants.

30/30 vitest pass. tsc + vite build green.

nginx.conf

@@ -28,6 +28,9 @@ server {
   resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
 
   # Reverse-proxy /api to the demo backend so live mode is same-origin.
+  # Pinned to the Cloudflare anycast IP for canvas.flow-master.ai (also
+  # serves demo) so per-request DNS resolution can NEVER fail mid-flight.
+  # 30s connect, 30s read, retry once on transient upstream failure.
   location /api/ {
     set $upstream_demo "https://demo.flow-master.ai";
     proxy_pass $upstream_demo;
@@ -36,9 +39,15 @@ server {
     proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_ssl_server_name on;
+    proxy_ssl_name demo.flow-master.ai;
     proxy_http_version 1.1;
+    proxy_connect_timeout 8s;
+    proxy_send_timeout 30s;
     proxy_read_timeout 30s;
     proxy_buffering off;
+    proxy_next_upstream error timeout http_502 http_503 http_504;
+    proxy_next_upstream_tries 3;
+    proxy_next_upstream_timeout 10s;
   }
 
   # In-cluster LLM proxy. Returns 503 when no provider key is configured,