feat(assistant): tool-calling LLM assistant replacing NLP intent parser

[sammajayi]

Summary

Replaces the rule-based NLP parser (src/nlp/parser.ts) with a tool-calling LLM assistant as the recognition layer for open-ended requests, while preserving the platform's core integrity property: no money moves and no decision is attributed to the agent unless it went through the same verified, audited, idempotent paths every other feature uses. The model is a free-form planner; the codebase is the only executor.

• Tool registry (src/agent/tools/): typed, Zod-schema'd wrappers over existing service-layer functions only — read tools (portfolio_value, positions, transactions, protocol_rates, goal_status, followed_strategy) and action tools (deposit, withdraw, rebalance, create_recurring_deposit, create_alert_rule, adjust_strategy, follow_strategy, unfollow_strategy). A structural test (tests/unit/agent/tools/structural.test.ts) asserts no tool imports stellar/contract or stellar/wallet directly, and every non-read-only tool requires confirmation.
• Planner (src/agent/assistant/planner.ts): Anthropic tool-calling; every proposed call is re-validated against the tool's own Zod schema before anything runs — an out-of-schema or hallucinated tool name is rejected as a grounded error, never executed.
• Confirmation gate (src/agent/assistant/confirmations.ts): every action tool is dry-run and parked, and only executes on an explicit affirmative reply to the exact confirmed proposal, with a callId-based idempotency guard against a duplicated confirmation. This is the load-bearing safety property and is covered by its own test suite.
• Sub-account delegation: each tool declares a SubAccountPermission; checkSubAccountPermission() was extracted from src/middleware/subAccount.ts so the assistant orchestrator can enforce the identical permission rule outside of Express middleware (including for dry-run previews).
• Conversation memory (Redis-backed, TTL'd) and per-user/global token budgets, degrading to a graceful fallback reply — never a dead bot — when the model is unavailable or the budget is exhausted. Prometheus metrics for token spend, tool latency, and fallback rate.
• Audit: every executed tool call writes an AgentLog row.
• Channels: wired into src/whatsapp/handler.ts and src/telegram/handler.ts as an additive fallback — gated behind ASSISTANT_ENABLED (default off) and only reached for the unknown intent bucket, so every command the existing parser already recognizes is completely unaffected. New POST /api/v1/assistant/chat REST endpoint for the web app, documented in docs/openapi.yaml.
• Small supporting refactor: extracted executeWithdraw from processOnChainTransaction in src/controllers/transaction-controller.ts (mirroring the existing executeDeposit) so the withdraw tool has a proper service-layer entry point instead of a bespoke path.

Test plan

• tests/unit/agent/tools/structural.test.ts — no tool imports raw stellar primitives; every tool declares a sub-account permission; every non-read-only tool requires confirmation
• tests/unit/agent/assistant/confirmations.test.ts — confirmation scoping, TTL expiry, ambiguous-reply handling, executed-call idempotency
• tests/unit/agent/assistant/planner.test.ts — schema validation, hallucinated-tool rejection, strict-schema extra-field rejection
• tests/integration/agent/assistant.integration.test.ts — grounded read-tool answers, dry-run-then-confirm execution flow (through the real service path), cancellation, hallucination rejection, model-failure fallback
• Full existing suite green: 86 suites / 1257 tests passed
• npm run build / npm run lint clean

Closes #318

[Abidoyesimze]

Pls fix conflict

[sammajayi]

@Abidoyesimze done