Share the research runtime and connect the private console

[gilbertsahumada]

Problem and behavior

The web and local Mastra host previously composed backend services independently. Next.js now delegates business HTTP requests to the Hono API and consumes its DTOs; its database/provider dependencies are removed. The existing public design and sample labels are preserved.

A private /console supports agent creation and versioned configuration, plugins/tools, manual research, schedule/pause controls, history, forecasts, policy results and evidence. Requests use Supabase user sessions; operator enablement remains separate. Polling stops for terminal runs and suspends in hidden tabs. Manual admission retains an idempotency key across uncertain responses.

@pickler/agent-runtime contains the shared Mastra model, immutable prompts, tools and lease lifecycle. Local modules re-export it. The Queue/Cron-only research Worker uses this package without lab initialization, an HTTP server or Studio. Managed-agent connection checks are explicit operator commands. The API's Zod version now matches the shared schemas so invalid input reliably returns 400.

Validation

• 243 tests passed against isolated Supabase-local databases after extraction; focused console rejection tests also passed after stricter creation validation.
• All 10 workspace type checks, lint and formatting passed.
• Next.js production build and local Mastra build passed.
• No paid provider calls or remote deployment.

Delivery

Second of three sequential PRs, based on #24. OpenNext is pinned at 1.20.6. The following deployment PR supplies Worker resources/configuration, local workerd browser verification and isolated staging acceptance. This PR does not claim staging is deployed. No automatic merge.