Trustee API — REST + WebSocket server for the Trustee agent.
Wraps a [trustee_core::session::Session] and exposes it over HTTP.
Static frontend files are served from [trustee_web].
Authentication is optional. When [oidc] or [dev] sections are present
in the config TOML, all /api/v1/* endpoints require a valid JWT or dev
token. Otherwise, all endpoints are open.