feat: prompt template tech debt — tests, read-only endpoints, double-… (#67)

* feat: prompt template tech debt — tests, read-only endpoints, double-load fix, server creation modal

Close test coverage gaps for prompt templates:
- Resume with deleted template: verifies graceful degradation (template_content=None, warning logged)
- Threading safety: concurrent set_template/init_system_messages with no race conditions
- Factory passthrough: template kwarg propagation through WorkstreamManager.create()

Add read-only template listing endpoints (read scope, no content exposed):
- GET /v1/api/templates — prompt template summaries (name, category, is_default, origin)
- GET /v1/api/ws-templates — enabled workstream template summaries (name, description, model)
- Available on both server and console; Python + TypeScript SDK methods added
- Console creation modal switched from admin endpoint to read-scope endpoint

Eliminate double-load inefficiency in workstream creation:
- Template validation moved before mgr.create() (no create-then-rollback on invalid template)
- template kwarg plumbed through WorkstreamManager.create() and session factory
- _SessionFactory Protocol added for proper mypy typing

Add workstream creation modal to server web UI:
- Name, model, template dropdown, ws_template/profile dropdown
- Instrument panel aesthetic: gradient top border, blur backdrop, amber accent
- Focus trap, Escape/Enter keyboard handling, loading state, error display
- WCAG AA contrast compliance, reduced-motion support

* fix: add list_ws_templates SDK methods + regenerate OpenAPI snapshots

Add list_ws_templates() to Python SDK (async + sync) and listWsTemplates()
to TypeScript SDK for the new GET /v1/api/ws-templates server endpoint.
Add WsTemplateSummary + ListWsTemplateSummaryResponse TypeScript types.
Regenerate openapi-server.json and openapi-console.json snapshots.

Addresses Copilot review feedback on PR #67.

* fix: skip template pre-validation when resuming a workstream

When resume_ws is set, the request's template field is irrelevant —
resume() restores the template from workstream_config. Pre-validating
a stale template name would incorrectly return 400 before the resume
even runs.

Addresses Copilot review feedback on PR #67.

docs/api-reference.md

@@ -618,6 +618,67 @@ Each saved workstream object:
 
 ---
 
+### `GET /v1/api/templates`
+
+Returns a summary list of all available prompt templates. This is a read-only
+endpoint (requires `read` scope) that exposes template names and categories
+without revealing template content. Useful for populating template selectors
+in UIs or discovering available templates before creating a workstream.
+
+**Response:**
+
+```json
+{
+  "templates": [
+    {"name": "safety-guidelines", "category": "safety", "is_default": true, "origin": "manual"},
+    {"name": "mcp__server__code", "category": "", "is_default": false, "origin": "mcp"}
+  ]
+}
+```
+
+Each template summary:
+
+| Field        | Type   | Description                                          |
+|--------------|--------|------------------------------------------------------|
+| `name`       | string | Template name (used in `template` field on creation) |
+| `category`   | string | Template category                                    |
+| `is_default` | bool   | Whether template is auto-applied to all sessions     |
+| `origin`     | string | Template origin: `manual` or `mcp`                   |
+
+> **Note:** For full template management (create, update, delete, view content),
+> use the admin endpoints at `GET /v1/api/admin/templates` (requires `admin.templates` permission).
+
+---
+
+### `GET /v1/api/ws-templates`
+
+Returns a summary list of enabled workstream templates. This is a read-only
+endpoint (requires `read` scope) for populating template selectors in UIs.
+
+**Response:**
+
+```json
+{
+  "ws_templates": [
+    {"name": "code-review", "description": "Code review profile", "model": "gpt-5"},
+    {"name": "ops-triage", "description": "On-call triage", "model": ""}
+  ]
+}
+```
+
+Each workstream template summary:
+
+| Field         | Type   | Description                                     |
+|---------------|--------|-------------------------------------------------|
+| `name`        | string | Template name (used in `ws_template` on creation)|
+| `description` | string | Human-readable description                       |
+| `model`       | string | Model alias override (empty = use default)       |
+
+> **Note:** For full workstream template management, use the admin endpoints at
+> `GET /v1/api/admin/ws-templates` (requires `admin.templates` permission).
+
+---
+
 ### `POST /v1/api/send`
 
 Sends a user message to a workstream. Spawns a daemon worker thread that calls