feat: Read My Mind phase 2, the predictor and the brain button

The feature as pitched in docs/readmymind-plan.md: pressing the header
brain button predicts the prompt you were about to type, from the case's
intent profile plus everything the session already knows.

Backend:
- readmymind-context.ts: pure budgeted context assembler (9 ranked
  sources: pending approval dialog, user goals, last assistant turn tail,
  recent prompts, tool activity, git workspace signals, away context,
  sibling sessions, rethink state; 30 KB budget, whole-section drop from
  the bottom of the ranking, trust tiers stated in the prompt)
- readmymind-collectors.ts: transcript tail reader (the live watcher
  keeps only a 500-char snippet) and git signal collection (execFile,
  2s timeout, skipped for remote-SSH cases)
- readmymind-predictor.ts: one-shot claude -p in a throwaway tmux
  session, opus by default (readMyMindModel setting), strict JSON
  contract with 1-3 suggestions (continue / verify / redirect), newline
  stripping, 90s timeout; mutable singleton so route tests can stub it
- POST /api/sessions/:id/readmymind: claude-mode only (400), one
  prediction in flight per session (409 CONFLICT), rethink body
  { steer, rejected }; ownership via findSessionOrFail

Frontend:
- readmymind-ui.js (loadorder 11.3): header brain button, marker-hidden
  until readMyMindEnabled is ON, desktop only (phone key is phase 3);
  modal with editable suggestion + rationale and Send / Insert /
  Rethink / Dismiss; suggestion text rendered via value/textContent only
  and nothing ever auto-sends
- App Settings -> Panels checkbox for readMyMindEnabled; en + zh-CN
  strings

Verified end to end against a live isolated instance: transcript
capture, a real opus prediction grounded in the stated goals, rethink
steering, the 409, and the browser modal incl. Insert leaving the text
unsubmitted on the composer. 41 new unit/route tests; full test:ci
sweep green (4680 tests).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/web/schemas.ts

@@ -710,6 +710,19 @@ export const IntentGoalsSchema = z
   })
   .strict();
 
+/**
+ * Body of POST /api/sessions/:id/readmymind (Read My Mind predict). Both
+ * fields are the Rethink flow: `rejected` carries suggestions the user
+ * dismissed (strong negative signal, fed back verbatim), `steer` an optional
+ * free-text correction ("no, I meant the mobile bug").
+ */
+export const ReadMyMindPredictSchema = z
+  .object({
+    steer: z.string().max(2000).optional(),
+    rejected: z.array(z.string().max(1000)).max(10).optional(),
+  })
+  .strict();
+
 // ========== Configuration ==========
 
 /**
@@ -826,6 +839,12 @@ export const SettingsUpdateSchema = z
      * stored profiles stay until DELETE /api/sessions/:id/intent.
      */
     readMyMindEnabled: z.boolean().optional(),
+    /**
+     * Read My Mind predictor model override. Empty/absent = the AI-checker
+     * default (opus: prediction quality is the product and it runs only on an
+     * explicit press). Shell-safety is validated again at spawn time.
+     */
+    readMyMindModel: z.string().max(100).optional(),
     tunnelEnabled: z.boolean().optional(),
     // Action field (NOT persisted): explicit per-request acknowledgment that the
     // operator accepts exposing an UNAUTHENTICATED public tunnel (no CODEMAN_PASSWORD).