Feat v0.5.2 chat surface

Chat surface package (packages/chat/) with conversation list, message
thread, compose bar, participant sidebar, create conversation dialog,
typing indicators, read receipts, message editing, and message deletion.
Built on chat-core library with realtime event subscriptions.

Fix stale token login deadlock: REST client auth endpoints excluded
from 401 retry loop, 8s defensive boot timeout on auth.boot().

Fix bundled package permissions: auto-grant with NULL granted_by and
set status active on install.

Switch docker-compose to named volume for remote Docker host compat.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/js/sw/sdk/auth.js

@@ -209,13 +209,26 @@ export function createAuth() {
             // Suppress _on401Failure redirect during boot — boot handles 401 itself.
             _booting = true;
 
+            // Defensive timeout: boot MUST complete within 8s.
+            // If stale tokens cause a network hang or unexpected deadlock,
+            // clear tokens and let the login page render.
+            let timedOut = false;
+            const bootTimeout = setTimeout(() => {
+                timedOut = true;
+                console.warn('[sw.auth] Boot timed out — clearing stale tokens');
+                _clearTokens();
+                _booting = false;
+            }, 8000);
+
             // Fetch permissions (validates the access token)
             try {
                 await _fetchPermissions();
             } catch (e) {
+                if (timedOut) return;
                 if (e.status === 401) {
                     // Token expired — try refresh
                     const ok = await auth.refresh();
+                    if (timedOut) return;
                     if (ok) {
                         try { await _fetchPermissions(); }
                         catch (_) { _clearTokens(); }
@@ -226,6 +239,7 @@ export function createAuth() {
                     console.warn('[sw.auth] Boot: permissions fetch failed (keeping tokens):', e.message);
                 }
             } finally {
+                clearTimeout(bootTimeout);
                 _booting = false;
             }