Merge pull request #21 from Syedhusn/main

fix: critical gaps from sprint review — invitation auth, session datetime, webhook warning, idempotency scoping

Merge branch 'sprint-03/frontend'

Merge branch 'sprint-03/services'

Merge branch 'sprint-03/backend' into main (resolve 6 conflicts, keep sprint-01 implementations, add agent_blocked/paused, inserted_at fields)

Merge branch 'sprint-02/backend' into main (resolve analytics conflict, keep cost_cents from sprint-01)

feat: security layer, governance gates, budget enforcement E2E — sprint 03

feat: adapter stream halt fix, StaleCleanup EventBus, 102 new tests

fix: close 5 gaps found in Sprint 01 verification

feat: quality + security layer — XSS prevention, error boundaries, budget CRUD

chore: remove unused @cleanup_interval module attribute

fix(A-06): align analytics response keys with frontend TypeScript types

fix(A-05): wrap conversation send_message in Ecto.Multi transaction

fix(A-03): inject workspace_id from auth context into notification create

fix(A-01): wrap workflow + steps creation in Ecto.Multi transaction