[matthewchung5377]

A student starts a web chat with no account. The backend creates a random token and keeps only its hash, and that token lets the student's browser tab see its own conversation and nothing else (TDD 4.6.2). This ticket adds session creation, the dependency that checks the token, and the REST routes. The WebSocket comes later and uses the same token.

Changes:

• Added a nullable revoked_at TIMESTAMPTZ to Texter, so ending a conversation can invalidate the token. Migration.

• In backend/app/routers/chat.py, with schemas in backend/app/schemas/chat.py (ChatSessionDTO, ChatConversationDTO, and SendMessageDTO; ChatMessageDTO already exists from Build the messaging pipeline, web chat adapter, and event bus (W3-06) #74:
  POST /api/chat/sessions: generates a token (secrets.token_urlsafe(32)), creates a web Texter whose identity_hash is the token's hash, and returns ChatSessionDTO with conversation_id: null. Rate-limited to 10 per hour per IP.
  a get_current_texter dependency: reads Authorization: Bearer , hashes it, and loads the texter. Returns 401 invalid_token if the token is missing, unknown, or revoked.
  GET /api/chat/conversation?after=<message_id>: the texter's most recent conversation with its messages (only the ones after after, if it's given). Returns 404 no_conversation before the first message.
  POST /api/chat/messages with SendMessageDTO (body from 1 to 2,000 characters after trimming): goes through handle_inbound with WebChatAdapter and returns ChatMessageDTO. Rate-limited to 20 per minute per token.
  POST /api/chat/conversation/end: closes the open conversation with closed_by = texter, sets revoked_at on the texter, publishes conversation.closed to the assigned responder's portal topic, and returns 204

• Tests in backend/tests/test_chat_routes.py:
  a session returns a token, and the database holds only its hash
  a first message creates a conversation
  after returns only newer messages
  one texter can't see another texter's conversation
  after ending, the token stops working
  a too-long body gives 422
  the rate limits return 429
  no response includes texter_id, a hash, or a responder's name

Closes #90

[github-actions]

Backend Test Results

376 tests  +37   376 ✅ +37   11s ⏱️ +4s
  1 suites ± 0     0 💤 ± 0 
  1 files   ± 0     0 ❌ ± 0 

Results for commit c1f4cfa. ± Comparison against base commit 534d88a.

[calebyhan]

LGTM