feat(openbb): OpenBB Workspace agent bridge (#817)

Exposes the agent to OpenBB Workspace over the openbb-ai SDK, behind an
optional `openbb` extra.

Security repairs on top of the contribution:

- pro.openbb.co is no longer a default CORS origin. CORS is installed
  globally with credentials and keyless loopback mode admits safe GETs by
  peer address, so that default would have let scripts on the OpenBB
  origin read /sessions and /runs. Extra origins are now an additive
  opt-in (VIBE_TRADING_EXTRA_CORS_ORIGINS) declared in the typed config
  layer; the loopback-only defaults are unchanged.
- POST /v1/query carries require_auth. It reaches the full agent registry,
  which auto-registers the order tools, so an unauthenticated caller could
  have driven actions inside an already-active mandate.
- The three unadvertised LLM routes (chat title, dashboard title, prompt
  enhancement) are removed rather than authenticated: they were absent
  from the manifest and duplicated the existing authenticated title path.
- Conversation identity no longer hashes the first message. Any two
  conversations opening with the same text mapped onto one persistent
  session, leaking history between them, and later requests' full history
  was ignored. openbb-ai 2.1.0 exposes no conversation id, and the SDK
  contract is stateless with full history per request, so each request now
  runs an ephemeral session replaying the supplied history.
- The SDK is wired into the dev install and CI, with an explicit import
  check. It previously landed only in agent/requirements.txt while CI
  installs the extras, so every bridge test silently skipped and the
  feature could look green while being uninstallable.
- Workspace context is now ingested under an 8k budget instead of ignored,
  and widget-dashboard-search is advertised as false: widget groups carry
  metadata only, and the value round-trip is not implemented, so the model
  is told values are absent rather than left to invent them.

The contributor's requirements-lock.txt rewrite was dropped (stale
Python-3.12 regen with unrelated downgrades; the runtime targets 3.11).

Note for operators: a browser POST from a remote Workspace origin is still
refused by the pre-existing cross-site guard, independently of CORS and of
a valid token. Self-hosted same-origin Workspace and server-side callers
work; that boundary is pinned by a test.

.github/workflows/test.yml

@@ -28,7 +28,15 @@ jobs:
           -r requirements-lock.txt
 
       - name: Install dependencies
-        run: pip install -e ".[dev]"
+        # `openbb` is included so agent/tests/test_openbb_bridge actually runs:
+        # those tests importorskip on openbb_ai, so without the extra the whole
+        # OpenBB Workspace bridge would report green while never being exercised.
+        run: pip install -e ".[dev,openbb]"
+
+      - name: Verify optional extras under test are importable
+        # Fails loudly if the openbb extra stops resolving, instead of letting
+        # the bridge suite silently degrade to skips.
+        run: python -c "import openbb_ai, importlib.metadata as m; print('openbb-ai', m.version('openbb-ai'))"
 
       - name: Repository safety gates
         run: bash tools/ci_grep_gates.sh