[bitifirefly]

Changes

• Complete shared product navigation, chat input and message components for Dify and LangChain.
• Isolate backend drafts, uploads, navigation and late streaming callbacks.
• Apply shared server-side authorization, input moderation, quota reservation, concurrency and idempotent admission.
• Preserve each backend's current sole history writer and trusted task identity headers.
• Fix fixed-navigation overlap with conversation deletion on desktop and mobile.

Validation

• 218 suites / 2035 tests; root, API and shared types; changed-file quality checks; architecture guards; shared/API/Web production builds.
• Fresh and incremental PostgreSQL migration checks, restricted-role RLS, concurrency and quota regressions.
• Production-mode Stage acceptance: 44 browser checks, actual Dify and LangChain two-turn sessions, tools/memory, drafts, refresh/history, relogin and deletion.
• Human acceptance confirms conversation and persistence. Other scenarios are recorded as automated checks, not additional manual assertions.

Upgrade and Scope

• Apply the additive agent_submissions governance migration before updating API and Web together; refresh existing browser tabs.
• Keep database recovery and schema compatibility separate from application rollback. Existing Dify history is not rewritten.
• Merge-to-main delivery only: no version tag, Release or production deployment. Full AG-UI conversion and additional backend capabilities remain a separate phase.