feat: streaming responses, inactivity timeout, and per-project permission levels

[vinicius1209]

Summary

• Streaming responses: Real-time message delivery to Telegram via chatStream() — Claude uses stream-json, Gemini uses stdout streaming. Both adapters support buffered chunk callbacks with configurable minChunkSize.
• Inactivity timeout: Replaces the hard wall-clock timeout that was killing long-running agent tasks (e.g., spec-driven /feature workflows). The process now stays alive as long as it produces output, and is only killed after inactivity_timeout seconds (default 300s) of silence. A hard stream_timeout (default 3600s) acts as a safety net.
• Per-project permission levels: New permission_level config (readonly, read-write, full) with adapter-aware tool mapping. Claude gets --dangerously-skip-permissions and Gemini gets --yolo when needed. Supports advanced allowed_tools and skip_permissions overrides per project.
• Setup wizard: New step 5/5 in devbridge init asks permission level per project.
• Log rotation: Auto-rotates at 10MB, keeps 5 archived files.
• Router refactored: Extracted streaming/non-streaming helpers, eliminated code duplication in SESSION_EXPIRED recovery path.
• Docs updated: configuration.md, security.md, adapters.md, README.md — all reflect the new features.

Permission Levels

Level	Claude Tools	Gemini Tools	Permission Bypass
readonly (default)	Read,Glob,Grep	ReadFileTool,GlobTool,GrepTool	No
read-write	+ Write,Edit,MultiEdit	+ WriteFileTool,EditTool	Yes
full	+ Bash,Agent,WebFetch,WebSearch,NotebookEdit	+ ShellTool,WebFetchTool,WebSearchTool	Yes

Config Example

{
  "projects": {
    "my-app": {
      "path": "/path/to/project",
      "adapter": "claude",
      "permission_level": "full"
    }
  },
  "defaults": {
    "stream_timeout": 3600,
    "inactivity_timeout": 300
  }
}

Test plan

• All 287 tests passing (36 test files)
• ESLint clean (0 errors, 0 warnings)
• Manual test: send a long-running /feature prompt via Telegram and verify no timeout while Claude is actively working
• Manual test: verify readonly project blocks write operations
• Manual test: verify full project allows file creation without permission prompts
• Manual test: verify devbridge init wizard asks permission level per project