merge: integrate origin/main (406 commits) into live branch

Merge upstream's paired-room stabilization, dedicated message-runtime-loop,
outbound delivery refactor (ipc-outbound-delivery / deliverFormattedCanonicalMessage),
discord module split, dashboard rework, and migrations 015-018 into our branch.

Conflict policy: prefer upstream for the heavily-refactored paired-room /
message-runtime / db cluster (it supersedes our earlier loop band-aids), keep
only orthogonal unique fixes:
- codex bundled-JS launcher fix (codex-warmup.ts)
- slot-aligned Claude+Codex usage primer (usage-primer.ts) re-wired into index.ts
- MemoryHigh=3G cgroup bound, discord perms diagnostic, prompt docs
- progress null-race + silent-failure publish guards (message-turn-controller.ts)

Dropped (superseded by upstream or unwired): reviewer STEP_DONE/TASK_DONE loop
band-aids, router markdown-escape override, register tribunal-default+git-init,
restart-context rewindToSeq (unwired).

Verified: typecheck clean, build clean, vitest shows zero new regressions vs the
origin/main baseline (only pre-existing env-config failures remain).

src/config/load-config.ts

@@ -135,6 +135,34 @@ function assertNoLegacyEnvAliasesConfigured(): void {
   );
 }
 
+function buildPathsConfig(
+  projectRoot: string,
+  homeDir: string,
+): AppConfig['paths'] {
+  return {
+    projectRoot,
+    homeDir,
+    senderAllowlistPath: path.join(
+      homeDir,
+      '.config',
+      'ejclaw',
+      'sender-allowlist.json',
+    ),
+    storeDir: path.resolve(
+      readNonEmptyText('EJCLAW_STORE_DIR') ?? path.join(projectRoot, 'store'),
+    ),
+    groupsDir: path.resolve(
+      readNonEmptyText('EJCLAW_GROUPS_DIR') ?? path.join(projectRoot, 'groups'),
+    ),
+    dataDir: path.resolve(
+      readNonEmptyText('EJCLAW_DATA_DIR') ?? path.join(projectRoot, 'data'),
+    ),
+    cacheDir: path.resolve(
+      readNonEmptyText('EJCLAW_CACHE_DIR') ?? path.join(projectRoot, 'cache'),
+    ),
+  };
+}
+
 export function loadConfig(): AppConfig {
   assertNoLegacyEnvAliasesConfigured();
 
@@ -176,29 +204,7 @@ export function loadConfig(): AppConfig {
       codexMainId: codexMainServiceId,
       codexReviewId: codexReviewServiceId,
     },
-    paths: {
-      projectRoot,
-      homeDir,
-      senderAllowlistPath: path.join(
-        homeDir,
-        '.config',
-        'ejclaw',
-        'sender-allowlist.json',
-      ),
-      storeDir: path.resolve(
-        readNonEmptyText('EJCLAW_STORE_DIR') ?? path.join(projectRoot, 'store'),
-      ),
-      groupsDir: path.resolve(
-        readNonEmptyText('EJCLAW_GROUPS_DIR') ??
-          path.join(projectRoot, 'groups'),
-      ),
-      dataDir: path.resolve(
-        readNonEmptyText('EJCLAW_DATA_DIR') ?? path.join(projectRoot, 'data'),
-      ),
-      cacheDir: path.resolve(
-        readNonEmptyText('EJCLAW_CACHE_DIR') ?? path.join(projectRoot, 'cache'),
-      ),
-    },
+    paths: buildPathsConfig(projectRoot, homeDir),
     runtime: {
       pollInterval: 2000,
       schedulerPollInterval: 60000,
@@ -268,6 +274,7 @@ export function loadConfig(): AppConfig {
         readNonEmptyText('WEB_DASHBOARD_STATIC_DIR') ??
           path.join(projectRoot, 'apps', 'dashboard', 'dist'),
       ),
+      token: readNonEmptyText('WEB_DASHBOARD_TOKEN') ?? '',
     },
     codexWarmup: {
       enabled: readBoolean('CODEX_WARMUP_ENABLED', false),

src/config/schema.ts

@@ -83,6 +83,7 @@ export interface AppConfig {
     host: string;
     port: number;
     staticDir: string;
+    token: string;
   };
   codexWarmup: {
     enabled: boolean;