Claude Prompt: Add Behest Chat

Reference docs for Behest (inference gateway):
- /docs/llms.txt
- /docs/authentication.md
- /docs/sdk-typescript.md
- /docs/guides/error-handling.md

Key facts to keep in mind:
- Behest is OpenAI-SDK compatible. Base URL is https://{slug}.behest.app/v1 (slug from dashboard).
- Env var is BEHEST_KEY (behest_sk_live_... for apiKey mode, behest_pk_... for sign mode). It lives ONLY on the server. Never send to browser.
- Server uses the @behest/client-ts v1.5 SDK: `new Behest()` reads BEHEST_KEY; `behest.auth.mint({ user_id })` returns `{ token, ttl, sessionId, expiresAt }`.
- Frontend fetches that token from a server endpoint we control, then calls Behest DIRECTLY from the browser using `fetch` or `new OpenAI({ apiKey: token, baseURL, dangerouslyAllowBrowser: true })`. No Behest SDK in the browser.
- Per-request headers: X-Thread-Id (persistent history) or X-Session-Id (ephemeral, set from mint result).
- JWT claim `uid` must be the authenticated user's id from my auth system.
- Error classes (server-side SDK): BehestQuotaError (402), BehestRateLimitError (429; has .retryAfter in seconds), BehestAuthError (401/403), BehestBadRequestError (400/422), BehestServerError (5xx). Trace id is on err.traceId.

SECURITY NON-NEGOTIABLES (do not deviate)
- BEHEST_KEY is server-only. Never under VITE_/NEXT_PUBLIC_/EXPO_PUBLIC_.
- user_id (the JWT `uid` claim) MUST be derived from the verified session on the server. Do NOT read it from the request body, query string, or any client-controlled header.
- tier MUST come from your billing system (DB row, Stripe metadata). Never hardcoded, never taken from the client.
- role is derived from the API key on the server. Never pass role in the mint body; admin access requires an admin-roled API key.
- The token-mint endpoint must NOT use wildcard CORS (Access-Control-Allow-Origin: *). Use a specific origin from env.
- Local signing (if used): private key stays server-only. The SDK refuses to load it in a browser — do not try to work around that.

Goal: add a production-ready Behest-backed chat to this app.

Constraints:
1. Use the existing auth system. Do NOT introduce a new auth library.
2. Server uses @behest/client-ts v1.5. Mint endpoint: const behest = new Behest(); const result = await behest.auth.mint({ user_id }). Next.js → route handler; Express → POST /api/behest/token; Supabase Edge Function → equivalent.
3. The browser must NOT import @behest/client-ts. It fetches the token from our server endpoint and calls Behest directly via fetch() or `new OpenAI({ apiKey: token, baseURL: `https://${SLUG}.behest.app/v1`, dangerouslyAllowBrowser: true })`.
4. Chat uses threads (X-Thread-Id header). Default to one thread per visit; allow passing an explicit threadId prop.
5. Streaming via stream: true; render deltas as they arrive; support cancel via AbortController wired to a Stop button.
6. Handle errors: 402 → upgrade modal; 429 → backoff toast (respect Retry-After header in seconds); 401 → re-fetch token and retry once, then re-auth.

Deliverables:
- All code needed to run the feature.
- A TESTING section with: env vars to set, a curl to test the token
  endpoint, and a browser test plan (sign in → chat → verify in Behest
  dashboard).
- A NEXT STEPS section listing two or three obvious improvements
  (thread sidebar, usage meter, local signing) and link to the relevant
  Behest docs for each.

Non-goals (do not do unless I ask):
- Tool calls / function calling.
- RAG / embeddings / vector store.
- Voice / vision.
- Swapping models dynamically from the UI.
- Admin / analytics UI.

Format:
- Write files in fenced code blocks with the full path as the first line.
- At the end, print a bullet list of all files you created or modified.

Before we ship, check your implementation against
/docs/guides/error-handling.md and
/docs/guides/streaming-ui.md. List any
gaps and fix them.

Swap BEHEST_KEY from behest_sk_live_ (apiKey mode) to behest_pk_ (sign
mode, tenant RSA PEM). Add BEHEST_KID, BEHEST_TENANT_ID, BEHEST_PROJECT_ID
env vars. See /docs/guides/auth-modes.md. The
SDK auto-detects the mode by key prefix — no code change in the mint
handler or the frontend.