refactor(agents): migrate .agent/ planning tree to .agents/

Standardize on the .agents/ directory (shared with project skills):
phases/, user_stories/, reports/, screenshots/, validate.sh, and
phase-sessions/ + pipeline.log all move to .agents/ (git mv preserves
history; runtime artifacts move alongside).

Updates every reference in AGENTS.md, README.md, .gitignore, app
docstrings, and test story headers. Historical KB content in data/
and the runtime pipeline.log transcript are left untouched.

.agents/reports/10_story_document_viewer.a1.md

@@ -0,0 +1,18 @@
+Phase 10 complete — all gates green, committed as `6ec6181`.
+
+**Implemented**
+- `GET /api/documents/content?source=…&path=…` (`app/api/docs.py`, `DocContent` in `app/schemas.py`) — DB-only lookup, 404 `{detail:"document not found"}`, `format` from lowercased suffix (`text` fallback)
+- Extracted the escape-first markdown renderer to `frontend/assets/markdown.js` (classic script, relative `<script src>` on `index.html` + `document.html`); rendering unchanged
+- New dark-themed viewer page `frontend/document.html` + `document.js`: back link (history-aware), title, meta badges (source/format/mono path/indexed/chunks), md → ≤46rem rendered column, other formats → escaped `<pre class="doc-raw">`, designed 404 not-found card, landmarks/skip-link/`aria-live`/focus-to-main
+- Chat source chips + Sources-table path links → viewer in a new tab (`target="_blank" rel="noopener"`, percent-encoded URLs); no-CDN + emoji guards extended to the viewer; README UI section
+
+**Verification**
+- `uv run pytest --cov=app --cov-report=term-missing` → 201 passed, **99%** on `app/` (>90%)
+- `uv run ruff check .` → clean; `uv run pyright` → 0 errors
+- `uv run pytest tests/e2e/test_document_viewer.py -v --no-cov` → 5 passed (isolated)
+- All 9 existing story E2E suites re-run in isolation → all pass (incl. XSS-proofing E2E: `<script>` fixture renders escaped, no dialog)
+
+**Notable**
+- E2E source values are `docs` (imported-dir basename) with slash-bearing paths — exactly what the query encoding handles; updated the now-stale chip-href assertion in the phase-03 suite (`/sources.html` → encoded viewer URL) and kept the cell-level `title` (phase-02 contract) alongside the link's.
+
+**Next pending phase:** none — `10_story_document_viewer.md` was the last in `todo/` (roadmap complete).