HTTP API: a chat's recent messages, and sending a message (closes #5)

`GET /api/v1/chats/{id}/messages?count=N` returns a chat's recent messages, oldest first (`count` 1 to 100, default 20), and `POST` to the same path sends a text message and returns it once the chat client has taken it. Both answer `404` for any id the chats list does not show, looked up in the same contact list. The message record is defined once, for the webhooks to reuse.

Disclosures: items are read five at a time, because one item can be many times its text and 100 at once could pass the 16 MiB read limit; text too long gets `413`, a contact who deleted the chat `409` (unverified for one still connecting); a query the server cannot read gets its own `400`.

Model: opus-5-5

README.md

@@ -89,7 +89,7 @@ variables that are absent.
 ## API
 
 An HTTP API beside the chat client lets another program read the bot's
-chats. It speaks JSON on `PORT`.
+chats and send messages in them. It speaks JSON on `PORT`.
 
 **Authentication.** Every request carries the credential from
 `API_TOKEN_FILE`:
@@ -133,6 +133,91 @@ curl -H "Authorization: Bearer $TOKEN" http://127.0.0.1:8080/api/v1/chats
   with the bot. The chat stays in the list, but nothing more reaches
   them.
 
+### `GET /api/v1/chats/{id}/messages`
+
+The latest messages in the chat `id`, oldest first. `count`, a whole
+number from 1 to 100 and 20 if absent, is how many of the chat's latest
+items to read. The chat client also records events in a chat, such as
+the contact connecting, and only messages are returned, so fewer than
+`count` can come back.
+
+```sh
+curl -H "Authorization: Bearer $TOKEN" \
+    'http://127.0.0.1:8080/api/v1/chats/3/messages?count=5'
+```
+
+```json
+{
+    "messages": [
+        {
+            "id": 9,
+            "direction": "received",
+            "type": "text",
+            "text": "2 + 2",
+            "time": "2026-09-29T03:14:34Z"
+        },
+        {
+            "id": 10,
+            "direction": "sent",
+            "type": "text",
+            "text": "4",
+            "time": "2026-09-29T03:14:35.101223457Z"
+        }
+    ]
+}
+```
+
+A message has:
+
+- `id` — its number, unique across all the bot's chats.
+- `direction` — `received` from the contact, or `sent` by the bot.
+- `type` — `text`, or another kind of SimpleX message, such as `image`,
+  `file` or `voice`.
+- `text` — the text; for a message that is not `text`, its caption,
+  which can be empty.
+- `time` — in RFC 3339, in UTC: for a received message, when it reached
+  the SimpleX relay, to the second; for a sent one, when the bot sent
+  it.
+
+The answer is `400` if `count` is not a whole number from 1 to 100, and
+`404` if `GET /api/v1/chats` does not list `id`. A query the server
+cannot read gets `400` with `the query cannot be read`; examples are a
+query that holds a `;`, a `%` not followed by two hexadecimal digits, or
+more than 10,000 parts separated by `&`.
+
+### `POST /api/v1/chats/{id}/messages`
+
+Sends the `text` in the body to the chat `id`, and answers `201` with
+the message as sent. The answer comes once the chat client has taken the
+message, before it reaches the contact.
+
+```sh
+curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
+    -d '{"text":"hello"}' http://127.0.0.1:8080/api/v1/chats/3/messages
+```
+
+```json
+{
+    "message": {
+        "id": 12,
+        "direction": "sent",
+        "type": "text",
+        "text": "hello",
+        "time": "2026-09-29T03:14:43.519552587Z"
+    }
+}
+```
+
+Nothing is sent, and the answer is:
+
+- `400` if the body is not JSON of that shape, or `text` is empty;
+- `404` if `GET /api/v1/chats` does not list `id`;
+- `409` if the contact cannot receive messages: they have deleted their
+  chat with the bot (`contact_deleted` is `true`), or have not finished
+  connecting;
+- `413` if the body is over 64 KiB, or the text is too long for one
+  SimpleX message, which holds about 15,000 bytes.
+
 ## Entrypoints
 
 This repo adheres to the