Studio chat completion: BFF contract for agent mentions and slash commands #2161

Parent: #2160. Design reference: stacklok/mecatl-prototypes#39 (open prototype).

Outcome

The browser can read the agent handles and the per-session slash commands a deployment offers, through the BFF, without ever holding a daemon credential.

Scope

• Add GET /api/v1/agent-mentions (handle, name, description) and GET /api/v1/sessions/{sessionId}/slash-commands (name, description) as read-only BFF projections of the published SDK. Include skills in the slash-command list, since every discovered skill is also available as /<skill-name>.
• Gate them on the agents and slashCommands capabilities with a clear unsupported response, and authorize them to the signed-in caller.
• Add Zod schemas, regenerate the contracts, and add BFF tests for the supported, unsupported, and unauthorized paths.

Acceptance

• Anonymous requests cannot list agents or commands; unsupported deployments return a capability explanation instead of an empty success.
• A session's command list reflects that session's own sources.
• Contract/BFF tests and task studio:check pass.

Delivery

Bounded BFF contract addition; use the published SDK only. No browser change in this issue.

Depends on: #1847.

Fully or partially written by an AI agent.