HTTP API: server, credential and the list of chats (closes #4)

The bot now serves an HTTP API on PORT (default 8080) beside the chat
client. Every request needs the credential read at startup from the
file named by API_TOKEN_FILE, sent as a bearer token; without one,
every request is refused. Responses carry the security headers, bodies
are capped at 64 KiB and each request's work at 10 seconds.

GET /api/v1/chats lists the bot's contacts from the chat client's
/_contacts command, ordered by id, and marks the contacts who deleted
their chat with the bot, which the chat client keeps listing. bot.Run
starts the API after set-up and stops it within 5 seconds; a listener
failure ends the bot as a chat client failure does.

Model: opus-5-5

internal/simplex/client.go

@@ -168,6 +168,18 @@ func (c *Client) SetAddressSettings(
 	return c.command(ctx, cmd, TypeUserContactLinkUpdated, nil)
 }
 
+// Contacts returns the user's contacts: everyone it has a direct chat
+// with.
+func (c *Client) Contacts(ctx context.Context, userID int64) ([]Contact, error) {
+	var r struct {
+		Contacts []Contact `json:"contacts"`
+	}
+
+	err := c.command(ctx, cmdListContacts(userID), TypeContactsList, &r)
+
+	return r.Contacts, err
+}
+
 // SendText sends a text message to a contact, as a reply to the message
 // quotedItemID (0 for none). It does not wait for the chat client to
 // accept it; a failure is logged when the client's answer arrives.