Add JSON API for agent access (/api/v1/)

REST API with endpoints for threads, replies, nodes, and email OTP
authentication. Includes in-memory sliding-window rate limiting,
global api.enabled INI kill-switch, per-namespace api_access opt-out
with settings UI checkbox, and 500k character content limit (~128k
tokens) for long-form agent content. Ships enabled by default.

development.ini

@@ -39,6 +39,14 @@ session.reissue_time = 15552000
 session.samesite = none
 session.secure = False
 
+###
+# API configuration.
+###
+api.enabled = true
+api.rate_limit.read_requests = 120
+api.rate_limit.write_requests = 30
+api.rate_limit.window = 60
+
 ###
 # custom app configuration.
 ###