feat: tool permission toggles, settings improvements, UI polish

- Tool permissions (read, edit, bash) stored in DB and control Agent tool registration
- Agent invalidated when permissions change; cache warning in Permissions panel
- Default: read=allow, edit=ask, bash=ask (matches UI checkboxes)
- Settings: auto-save title model on selection (removed save button)
- Settings: auto-expand thinking checkbox with shared reactive store
- Permissions panel: renamed from Permission Log, shows tool toggles + collapsible log
- Sidebar: renamed Current Model to Model Choice
- Chat input: allow typing while agent runs (just disable send)
- Chat cursor: fix doubled rectangle (removed unicode char)
- Generic GET/PUT /tabs/settings/:key endpoints for key-value settings

1 files changed, 28 insertions, 3 deletions

diff --git a/packages/api/src/routes/tabs.ts b/packages/api/src/routes/tabs.ts
index 7fe05d9..288cd51 100644
--- a/packages/api/src/routes/tabs.ts
+++ b/packages/api/src/routes/tabs.ts
@@ -10,6 +10,7 @@ import {
 	getMessagesForTab,
 	getSetting,
 	setSetting,
+	deleteSetting,
 } from "@dispatch/core";
 
 export const tabsRoutes = new Hono();
@@ -41,9 +42,15 @@ tabsRoutes.get("/settings/title-model", (c) => {
 });
 
 tabsRoutes.put("/settings/title-model", async (c) => {
-	const body = await c.req.json<{ keyId?: string; modelId?: string }>();
-	if (body.keyId) setSetting("title_model_key_id", body.keyId);
-	if (body.modelId) setSetting("title_model_id", body.modelId);
+	const body = await c.req.json<{ keyId?: string | null; modelId?: string | null }>();
+	if (body.keyId !== undefined) {
+		if (body.keyId) setSetting("title_model_key_id", body.keyId);
+		else deleteSetting("title_model_key_id");
+	}
+	if (body.modelId !== undefined) {
+		if (body.modelId) setSetting("title_model_id", body.modelId);
+		else deleteSetting("title_model_id");
+	}
 	return c.json({ success: true });
 });
 
@@ -72,6 +79,24 @@ tabsRoutes.patch("/:id", async (c) => {
 	return c.json(tab);
 });
 
+// ─── Settings ─────────────────────────────────────────────────
+
+tabsRoutes.get("/settings/:key", (c) => {
+	const key = c.req.param("key");
+	const value = getSetting(key);
+	return c.json({ value });
+});
+
+tabsRoutes.put("/settings/:key", async (c) => {
+	const key = c.req.param("key");
+	const body = await c.req.json<{ value?: string }>();
+	if (typeof body.value !== "string") {
+		return c.json({ error: "value is required" }, 400);
+	}
+	setSetting(key, body.value);
+	return c.json({ success: true });
+});
+
 tabsRoutes.delete("/:id", (c) => {
 	const id = c.req.param("id");
 	const mgr = getAgentManager();