refactor: Cleanup git state - commit all staged changes

Major refactoring cleanup:
- Add new controller architecture (class-controller-*.php)
- Add new settings-v2 UI (views/settings-v2/)
- Add new CSS architecture (agentic-sidebar.css, tokens)
- Add esbuild build pipeline (scripts/build.js, package.json)
- Add composer dependencies (vendor/)
- Add frontend src directory (assets/js/src/index.jsx)
- Add documentation files
- Remove old/obsolete files (class-settings.php, old CSS)

This commits all pending changes from previous refactoring efforts.

includes/class-controller-session.php

@@ -0,0 +1,114 @@
+<?php
+/**
+ * Session REST Controller
+ *
+ * Handles session lock operations for multi-tab safety.
+ *
+ * @package WP_Agentic_Writer
+ */
+
+/**
+ * Class WP_Agentic_Writer_Controller_Session
+ *
+ * REST controller for session operations.
+ *
+ * @since 0.3.0
+ */
+class WP_Agentic_Writer_Controller_Session {
+
+    /**
+     * Sidebar instance for dependency access.
+     *
+     * @var WP_Agentic_Writer_Gutenberg_Sidebar
+     */
+    private $sidebar;
+
+    /**
+     * Constructor.
+     *
+     * @since 0.3.0
+     * @param WP_Agentic_Writer_Gutenberg_Sidebar $sidebar Sidebar instance.
+     */
+    public function __construct( $sidebar ) {
+        $this->sidebar = $sidebar;
+    }
+
+    /**
+     * Handle session lock acquire/refresh (heartbeat).
+     *
+     * @since 0.2.0
+     * @param WP_REST_Request $request REST request.
+     * @return WP_REST_Response|WP_Error
+     */
+    public function handle_session_lock( $request ) {
+        $params     = $request->get_json_params();
+        $session_id = sanitize_text_field( $request->get_param( 'session_id' ) );
+        $tab_id     = sanitize_text_field( $params['tab_id'] ?? '' );
+        $force      = ! empty( $params['force'] );
+
+        if ( ! $tab_id ) {
+            return new WP_Error(
+                'missing_tab_id',
+                __( 'tab_id is required.', 'wp-agentic-writer' ),
+                [ 'status' => 400 ],
+            );
+        }
+
+        $manager = WP_Agentic_Writer_Conversation_Manager::get_instance();
+
+        if ( ! $manager->current_user_can_access( $session_id ) ) {
+            return new WP_Error(
+                'forbidden',
+                __(
+                    'You do not have permission to access this conversation.',
+                    'wp-agentic-writer',
+                ),
+                [ 'status' => 403 ],
+            );
+        }
+
+        // Force mode: use a 0 window so any existing lock is treated as expired.
+        $window = $force ? 0 : 60;
+        $result = $manager->acquire_lock( $session_id, $tab_id, $window );
+
+        return new WP_REST_Response( $result, 200 );
+    }
+
+    /**
+     * Handle session lock release.
+     *
+     * @since 0.2.0
+     * @param WP_REST_Request $request REST request.
+     * @return WP_REST_Response|WP_Error
+     */
+    public function handle_session_unlock( $request ) {
+        $params     = $request->get_json_params();
+        $session_id = sanitize_text_field( $request->get_param( 'session_id' ) );
+        $tab_id     = sanitize_text_field( $params['tab_id'] ?? '' );
+
+        if ( ! $tab_id ) {
+            return new WP_Error(
+                'missing_tab_id',
+                __( 'tab_id is required.', 'wp-agentic-writer' ),
+                [ 'status' => 400 ],
+            );
+        }
+
+        $manager = WP_Agentic_Writer_Conversation_Manager::get_instance();
+
+        if ( ! $manager->current_user_can_access( $session_id ) ) {
+            return new WP_Error(
+                'forbidden',
+                __(
+                    'You do not have permission to access this conversation.',
+                    'wp-agentic-writer',
+                ),
+                [ 'status' => 403 ],
+            );
+        }
+
+        $released = $manager->release_lock( $session_id, $tab_id );
+
+        return new WP_REST_Response( [ 'released' => $released ], 200 );
+    }
+}