fix: NATS pipeline bugs, add integration tests and service runners

Fix three critical bugs preventing the NATS message pipeline from working:

- FlowProcessor now subscribes to config-push topic (was missing entirely),
  using DeliverPolicy.All to replay config on service restart
- NATS streams use wildcard subjects (tg.flow.>) instead of per-topic
  narrow filters that caused 503 errors on publish
- Subscriber dispatch loop has exponential backoff on errors to prevent
  tight error loops

Add service runner scripts (gateway, config, LLM) and a 7-test
integration suite that verifies config CRUD, WebSocket round-trip,
and full LLM text-completion through the NATS pipeline.

Fix Docker Compose infra: pin Tempo to v2.6.1, remove deprecated Loki
config fields, add user:0 for volume permissions, remap conflicting
ports (FalkorDB 6380, OTLP 4327/4328).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ts/scripts/reset-nats.ts

@@ -0,0 +1,19 @@
+import { connect } from "nats";
+
+async function main() {
+  const nc = await connect({ servers: "nats://localhost:4222" });
+  const jsm = await nc.jetstreamManager();
+
+  try {
+    const info = await jsm.streams.info("tg_flow");
+    console.log("Current stream subjects:", info.config.subjects);
+    await jsm.streams.delete("tg_flow");
+    console.log("Deleted tg_flow stream");
+  } catch (e) {
+    console.log("No stream to delete:", (e as Error).message);
+  }
+
+  await nc.close();
+}
+
+main();