feat: compact context by model window

[EvanProgramming]

Summary

• Replace the fixed character trigger with model-window token pressure, a 4,096-token output reserve, bounded untrusted digests, and one recognized-overflow retry.
• Add default model windows, encrypted-config and environment overrides, durable content-free context status, and the expandable web token meter.
• Preserve the latest digest through 32-message history/session windows and retain recent work; mark omissions if active-model summarization fails.

Validation

• make check (including the managed Go TUI check)
• make lint
• make test — 271 passed
• make docs-check
• git diff --check
• Focused API/SSE/context compaction tests

Browser and API evidence

A local fake-provider browser run rendered the live expanded meter and reply: Context: 3K / 128K tokens; input was labeled estimated, the reserve was 4.1K, remaining capacity 121K, and the model source was gpt-4o (model_catalog). API/SSE tests verify the content-free status payload, context event, and restored-session status.

Configuration and safety

Custom models may declare context_window_tokens in encrypted provider configuration or KYROZEN_CONTEXT_WINDOW_TOKENS. Unknown models never compact proactively; a recognized provider overflow receives one compact-and-retry attempt. Digests are explicitly untrusted and the UI exposes no prompt, memory, or system-instruction content.