feat(rag): stream grounded RAG answers over SSE with source citations

Phase 03 (Story: Chat RAG Answer — happy path):
- app/rag/retriever.py: top-k cosine search + parent-doc selection with
  per-doc dedupe and BOR_MAX_CONTEXT_CHARS cap ([…truncated…] marker)
- app/rag/prompts.py: locked persona + HIGH/DEFLECT prompt builders
- app/rag/llm.py: LLMError + chat_stream (turbo, temp 0.4, max 700, stream)
- app/api/chat.py: POST /api/chat SSE — delta* then done{deflected,
  sources, suggestions}; query_log row + PLAN §9 per-turn log line;
  structured error event on mid-stream failure, JSON 503 when DB down
- frontend: SSE reader, live bubble streaming, source chips -> /sources.html,
  red role=alert banner, Send button state that always recovers
- fix(scaffold): [hidden] { display: none !important } — .kb-banner's
  display:flex was overriding the hidden attribute (banner always visible)
- tests: unit (retriever/prompts/sse/llm) + integration (real Postgres RAG
  turn, query_log, error + 503 paths, mid-turn failures) + Playwright story
  suite (grounded answer, log row, raw SSE shape); smoke placeholder test
  replaced with the real never-stale-button contract

tests/unit/test_sse_events.py

@@ -0,0 +1,48 @@
+"""Unit: SSE frame serialization for POST /api/chat (PLAN §4 contract)."""
+from __future__ import annotations
+
+import json
+
+from app.api.chat import sse_event
+
+
+def _payload(frame: str) -> dict:
+    assert frame.startswith("data: ")
+    assert frame.endswith("\n\n")
+    return json.loads(frame.removeprefix("data: ").strip())
+
+
+def test_delta_frame_serializes_exactly() -> None:
+    frame = sse_event({"type": "delta", "text": "hi"})
+    assert frame == 'data: {"type": "delta", "text": "hi"}\n\n'
+    assert _payload(frame) == {"type": "delta", "text": "hi"}
+
+
+def test_done_frame_carries_full_contract_shape() -> None:
+    payload = {
+        "type": "done",
+        "deflected": False,
+        "sources": [{"source": "Homelab", "path": "kubernetes.md", "title": "K8s"}],
+        "suggestions": [],
+    }
+    assert _payload(sse_event(payload)) == payload
+
+
+def test_error_frame_serializes() -> None:
+    frame = sse_event({"type": "error", "detail": "boom"})
+    assert _payload(frame) == {"type": "error", "detail": "boom"}
+
+
+def test_unicode_survives_roundtrip() -> None:
+    frame = sse_event({"type": "delta", "text": "🧠 café — \"quoted\""})
+    # ensure_ascii=False keeps the frame readable (no \uXXXX escapes).
+    assert "🧠 café" in frame
+    assert _payload(frame)["text"] == "🧠 café — \"quoted\""
+
+
+def test_multi_line_text_stays_one_frame() -> None:
+    """Newlines inside the JSON payload must be escaped so the frame
+    delimiter ``\\n\\n`` remains unambiguous."""
+    frame = sse_event({"type": "delta", "text": "line1\nline2\n\n"})
+    assert frame.count("\n\n") == 1  # only the frame terminator
+    assert _payload(frame)["text"] == "line1\nline2\n\n"