Add legacy data migration script and docs ...

- scripts/assign_legacy_sessions.py assigns user_id=NULL sessions,
  memory_facts, and memory_summary to a target user
  - Handles UNIQUE constraint conflicts in memory_facts by merging
  - Merges memory_summary if user already has one
- Update docs/auth.md with legacy migration section

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Support dynamic redirect_uri for multi-domain OAuth ...

- get_gauth_client(redirect_uri=...) creates per-request client with
  dynamic redirect_uri while keeping shared state/PKCE stores
- auth_login/auth_callback derive redirect_uri from request.base_url
  so both localhost and server addresses work with one gnexus-auth client

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Document multi-user auth system ...

- New docs/auth.md — comprehensive auth guide: OAuth flow, roles/permissions,
  webhooks, env vars, setup instructions, API reference, WebSocket auth,
  testing with mocked auth
- Update docs/config.md — add gnexus-auth OAuth env vars table
- Update docs/api.md — add /auth/*, /admin/*, /webhooks/gnexus-auth endpoints
- Update docs/index.md — add auth.md to file map
- Update docs/sessions.md — document user_id column and list_all filtering
- Update docs/memory.md — document user_id scoping in facts and summaries

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix DDL race condition and PostgreSQL syntax error on startup ...

- _ensure_auth_tables now uses raw asyncpg.connect instead of get_session_store,
  avoiding PgSessionStore._MIGRATE running before navi_users exists
- Move _ensure_auth_tables before ensure_tables in startup so navi_users is
  created before any foreign-key references
- Replace invalid "ADD CONSTRAINT IF NOT EXISTS" with DO $$ block for
  memory_facts_user_cat_key

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add gnexus-auth-client-py and cryptography to pyproject.toml dependencies ...

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Multi-user auth via gnexus-auth OAuth + hybrid role/permission model ...

- Integrate gnexus-auth-client-py (GAuthClient) for OAuth flow, token refresh,
  and webhook parsing
- Add navi/auth/ package: User model, Fernet encryptor, client singleton,
  deps (get_current_user, require_admin, require_permission)
- New tables: navi_users, user_auth_sessions (auto-created on startup)
- Session/memory isolation by user_id with legacy NULL support
- Cookie-based auth proxy: /auth/login, /callback, /logout, /me
- Webhook receiver /webhooks/gnexus-auth handling user events, global logout,
  session revocation, role/permission changes
- Admin endpoints (/admin/*) gated by role + permissions
- Webclient auth store with isAdmin/hasPermission guards
- Admin-only profile filtering in /agents/profiles
- 200/200 tests passing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Allow subagents to use selected profiles

Filesystem & share for discuss profile

Paginate session list loading

Refine 3D modeler workflow

Simplify 3D SCAD subagent prompt

Disable thinking stalls for 3D subagents

Relax 3D SCAD subagent constraints

Constrain 3D SCAD author subagents

Prioritize physical geometry in 3D profile

Checkpoint 3D subagent tool scope

Delegate 3D SCAD authoring to subagents

Improve 3D modeling validation prompts

Add 3D modeling specification workflow

Improve 3D modeling workflow discipline

Improve artifacts workspace controls

Add artifact source previews

Open artifact links externally on Android

Reduce spawn agent running indicators

Restore original scrollbar appearance

Fix 3D modeling feedback: session context, CORS, and PNG workflow ...

- Embed session_id into the main system prompt so the model reliably
  sees the correct session files directory instead of hallucinating one.
- Add global CORS middleware to fix STL viewer iframe fetch errors.
- Switch modeler_3d PNG previews from content_publish to image_view
  so renders are debug-only for Navi, not user-facing cards.
- Remove literal {session_id} template from persona.txt.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add 3D modeling profile with model_3d and render_3d tools ...

New profile:
- modeler_3d: 3D model design for 3D printing (OpenSCAD → STL)

New tools:
- model_3d: compile .scad → binary STL via OpenSCAD CLI
- render_3d: render PNG previews from STL (up to 3 views, 400×300)

Both tools return openscad_not_found error if OpenSCAD is not installed.

Docs:
- README.md: add modeler_3d to profile table
- docs/profiles.md: add modeler_3d to active profiles
- docs/tools.md: add model_3d and render_3d to builtin tools
- manuals/model_3d.md, manuals/render_3d.md: full usage manuals
- modeler_3d system_prompt.txt: OpenSCAD-first workflow with dedicated tools

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Normalize scrollbar styling

Improve content publishing UX

Complete phase 7 regression test coverage