#562 feat(api): migrate /api/sessions/[sessionId]/chats/[chatId] from open-agents

Summary

Ports the full chat-by-id route from open-agents' apps/web/app/api/sessions/[sessionId]/chats/[chatId]/route.ts to api so the frontend can cut over without behavior changes.

• GET /api/sessions/{sessionId}/chats/{chatId} → { chat: { id, modelId, activeStreamId }, isStreaming, messages }
• PATCH → { chat }. Body { title?, modelId? }; at least one field, both must be non-empty after trim. modelId is stored as-is (no model-variant sanitization until user-preferences are migrated).
• DELETE → { success: true }. Refuses with 400 if the chat is the only one in its session.

All three reuse the same gating: auth via validateAuthContext, 404 when session/chat is missing or chat lives in a different session, 403 on cross-account.

Test plan

• CI green
• Preview: GET with valid auth returns 200 + { chat, isStreaming, messages }
• PATCH { title } renames the chat; PATCH { modelId } updates model_id
• PATCH {} returns 400 "At least one field is required"
• DELETE succeeds when there are 2+ chats in the session
• DELETE on the only chat returns 400 "Cannot delete the only chat in a session"
• All four method variants without auth return 401

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added endpoints to retrieve chat details and message history
  • Added ability to update chat titles and model settings
  • Added chat deletion with validation to ensure sessions retain at least one chat
  • Enhanced API with CORS support and comprehensive error handling across all endpoints