Add AgentSessionService and refactor agent routes

Move session-related responsibilities into a new application-layer AgentSessionService (and AgentSessionFeedbackResult dataclass), provide a bootstrap factory (get_agent_session_service), and update agent API routes to call the service instead of accessing ConversationStore directly. Routes now translate ValueError into 404 responses and use service methods for get/list/history/delete/feedback. Also update package exports and docs/READMEs to declare the backend architecture authority, enforce api -> application -> domain ports -> infrastructure boundaries, and call out legacy services/workflows as migration-only. These changes centralize session logic in the application layer and tighten architecture guidance for future backend work.

AGENTS.md

@@ -39,6 +39,15 @@
 - `tests/verify_mvp.py` also expects the `BGEM3Embedder` stack to be available and explicitly mentions `FlagEmbedding`.
 - For backend-only changes, prefer focused import/startup checks unless you know the external services and model dependencies are available.
 
+## Backend Architecture Authority
+
+- `docs/architecture/backend-project-architecture.md` is the authoritative backend architecture document for ongoing backend development.
+- New backend business logic must follow `api -> application -> domain ports -> infrastructure`.
+- Treat `backend/app/shared/bootstrap.py` as the current composition root for backend dependency wiring.
+- Do not add new business orchestration to `backend/app/services/*` or `backend/app/workflows/*` unless the task is explicitly a migration step.
+- API routes must not directly access `ConversationStore`; session access should go through application services.
+- Legacy files may be patched for compatibility or bug fixes, but should not gain new long-term responsibilities.
+
 ## Backend Commenting Standard
 
 - All comments and docstrings in `backend/**/*.py` must be written in English.