feat: add terminal UI example

[yanpgwang]

Problem, rationale, and scope

The standalone mango-terminal repository exists to support Mango product demos, but its repository and executable names make it look like a separately supported product. It also installs a mango binary that conflicts with the server command in this repository.

This PR moves the complete client into the Mango repository as a reference example. The example remains runnable and tested, while release packaging and a supported operator-console contract are explicit non-goals.

What changed

• Imported the terminal client snapshot from mango-terminal@fdb62d0 into examples/terminal-ui.
• Kept it as an isolated Go module so Bubble Tea and rendering dependencies do not enter the server module.
• Renamed the example executable from mango to mango-tui and removed standalone install/release automation.
• Added built-in demo and connected-mode documentation, a Docusaurus guide, sidebar entry, README link, and demo GIF.
• Added Makefile targets and a dedicated CI job for tests, race tests, vet, and build.
• Included the nested module in vulnerability scanning and upgraded golang.org/x/text and github.com/yuin/goldmark to fix two reachable vulnerabilities found during the move.

Verification

• make test
• make test-race
• make vet
• make lint LINT_BASE=origin/main
• make terminal-ui-verify
• make security
• npm --prefix website run typecheck
• npm --prefix website run build
• Verified the generated guide contains the bundled demo GIF.

API impact and design provenance

There is no Mango server API or persistence-schema change. The example continues to consume the existing HTTP/SSE contract and documents its attach, reconnect, projection, and action-routing choices in examples/terminal-ui/ARCHITECTURE.md.

The UI implementation comes from the prior standalone Mango Terminal repository and uses the Charm Bubble Tea, Bubbles, Lip Gloss, and Glamour libraries. This PR changes its repository placement and product positioning, not the underlying interaction model.

Durability and security

There is no migration and no change to runtime side effects, sandboxing, or server durability. The client still rejects credentials embedded in endpoint URLs and never persists API keys. Both root and example modules now run through govulncheck; the imported example reports no reachable vulnerabilities after the dependency upgrades.

Checklist

• The problem, acceptance criteria, and non-goals are recorded here or in a linked design document/Issue.
• Tests cover the changed behavior.
• Public behavior is documented.
• Material external design influences and Mango-owned decisions are recorded.
• No credentials, generated build output, or local databases are included.

[yanpgwang]

Updated this existing demo PR onto the current main branch. The terminal client now uses Mango Authorization: Bearer authentication, sends no Anthropic beta/version headers, and the docs chapter lives under Examples rather than Guides. Verified against the real local stack: resource listing and direct Session attach/history/SSE projection worked. Local checks passed: terminal-ui-verify, go test ./..., and the Docusaurus typecheck/build.

[yanpgwang]

Addressed the final review findings and updated the branch to current main.

• Decode the documented Session Thread agent union, including Advisor model strings, and display Advisor roster identities.
• Project aggregate Session lifecycle events into the TUI action state and remove resolved partial-barrier actions by their client-visible IDs.
• Add attach generations and cancellation so stale or out-of-order responses cannot replace the selected Session.
• Exit reconnect cleanly on session.deleted or a reconnect 404.
• Fix the Terminal UI documentation URL and document that the bearer key selects the Workspace; no Workspace ID or API key is persisted.

Added regression coverage for Advisor refresh, attach cancellation/out-of-order completion, lifecycle action gating, child partial/full action resolution, external deletion, and reconnect 404.

Verified locally with make terminal-ui-verify, make verify, make docs-check, and repeated race-enabled barrier tests. A read-only subagent re-review reports no remaining actionable findings.