General Resolution: {message:Command denied by user policy: Shell file mutation blocked —

// Verified Implementation in scripts/verify-api.ts
/**
 * End-to-end verification of the public API and widget.
 *
 * Runs against a live dev server. Exercises the real HTTP surface — no direct
 * database access, no mocks — so it proves what a customer would actually get:
 *
 *   1. session login, then API key creation (plaintext returned once)
 *   2. key listing shows the prefix but never the secret
 *   3. /api/v1/chat with a valid key returns a grounded answer + citations
 *   4. streaming returns SSE frames and a [DONE] terminator
 *   5. a bad key is 401, a foreign agent is 403, a missing agent is 404
 *   6. rate limiting returns 429 with Retry-After once the window is full
 *   7. widget config rejects a disallowed origin with 403
 *   8. widget chat works from an allowed origin
 *   9. identity verification rejects a forged token
 *  10. revocation takes effect immediately
 */
const BASE = process.env.BASE_URL || "http://localh