HTTP API: server, credential and the list of chats (closes #4)

The bot now serves an HTTP API on PORT (default 8080) beside the chat
client. Every request needs the credential read at startup from the
file named by API_TOKEN_FILE, sent as a bearer token; without one,
every request is refused. Responses carry the security headers, bodies
are capped at 64 KiB and each request's work at 10 seconds.

GET /api/v1/chats lists the bot's contacts from the chat client's
/_contacts command, ordered by id, and marks the contacts who deleted
their chat with the bot, which the chat client keeps listing. bot.Run
starts the API after set-up and stops it within 5 seconds; a listener
failure ends the bot as a chat client failure does.

Model: opus-5-5

AGENTS.md

@@ -1,6 +1,6 @@
 ---
 title: Agent Guidance
-last_modified: 2026-09-28
+last_modified: 2026-09-29
 ---
 
 This file is the single source of guidance for any automated agent
@@ -119,6 +119,7 @@ Do not weaken them.
 
 ```
 cmd/simplexcalc/    main(), a single call into internal/cli
+internal/api/       the HTTP API: its credential, headers and endpoints
 internal/bot/       startup, address setup, and the reply to a message
 internal/calc/      the arithmetic: go/parser and go/constant
 internal/cli/       cobra command tree: run and version