Add trace annotations

[johnnygreco]

Summary

• Adds first-class trace annotations for sessions, messages, and events.
• Adds transcript UI controls, annotation drawer states, and annotation counts.
• Adds MCP annotation tools plus annotated-trace discovery/export APIs.
• Updates API/MCP docs and records QA evidence under docs/qa/trace-annotations/.

Spring Cleaning Audit

• Reviewed branch scope, repo instructions, CI, tool manifests, docs, generated templ files, and changed API/MCP/UI/test surfaces.
• Checked for branch debris: TODO/FIXME/debug leftovers, focused tests, generated drift, whitespace errors, stale docs, and accidental backwards-compatibility shims.
• No cleanup patch was warranted: the worktree is clean at b18c57fe56bad1959e0bba8ba96e5bcd3ee093f7, and the only new legacy_field mention is a strict JSON rejection test.
• No dependency or lockfile changes were made.

Validation

• git diff --check
• make generate-check
• make fmt-check
• make test
• make test-cover
• make build
• make lint
• npm run vendor:check
• npm run test:frontend
• npm run test:e2e
• npm run test:a11y
• npm run test:visual
• npx playwright test tests/e2e/trace-annotations-qa.spec.ts --reporter=line (3 skipped by design without BEACON_QA_CAPTURE=1)
• npm audit --audit-level=moderate
• GOTOOLCHAIN=go1.26.4 make vulncheck

Local Review Server

• Installed with make install-local INSTALL_DIR="$HOME/.local/bin".
• Restarted beacon-up from the installed binary using isolated review config /tmp/beacon-trace-annotations-dev.toml because the default local beacon database is still schema version 9 and this branch supports schema version 10.
• Verified http://localhost:4600/ with curl and a served dashboard screenshot.

[johnnygreco]

Panel review final status for feature/trace-annotations at b7650ec:

• First review pass found issues in CSRF/same-origin mutation protection, message-level MCP open refs, stale MCP docs, annotation drawer edit/delete UX, and frontend action labeling/focus behavior.
• Accepted fixes landed and were rerun. API/data, MCP tooling, annotation UX/agent experience, docs/privacy, and frontend robustness reviewers are now clean.
• Final focused rerun verified the last two gaps: focus fallback now ignores hidden duplicate annotation buttons, and architecture docs no longer describe MCP as read-only or migration-free.

Validation:

• node --test tests/js/transcript-annotations.test.cjs
• npm run lint:js
• npm run test:frontend
• npx playwright test tests/e2e/dashboard.spec.ts --grep "creates edits and deletes transcript annotations" --reporter=line
• npm run test:e2e (53 passed)
• npm run test:a11y (10 passed)
• git diff --check
• GitHub checks are green: build, format, generated, govulncheck, npm-audit, test, dependency-review, frontend, lint, playwright-accessibility, playwright-dashboard.

Local review server rebuilt and restarted from the installed binary at http://localhost:4600/.