Record pending visual preview requests from Planner

[MaggieAppleton]

What changed

Adds a zero-argument foreground Planner tool, request_visual_preview, for a member's explicit request to explore continuous design settings. Its durable domain operation records the exact active member message as a bounded pending request in the document sidecar and returns its ID only after the fenced commit. Repeated calls for the same message return the same ID, including after a room restart.

The record stores the channel, source message, original instruction, requester, source document revision, and server creation time. Background Planner jobs cannot call this writer. A stopped foreground turn rejects requests still waiting for the document lock, while an already committed request remains durable. Ordinary discrete team choices continue through ask.

Availability gate

There is no production request consumer or preview publisher. Normal hosted turns therefore omit the tool, its guidance, and its Chat callback. A complete injected test capability enables the three together and can publish a verified decision and resolve its artifact. A resolver or enable flag alone is insufficient. The portable local toolkit in #416 is not a hosted fulfillment provider.

Request flow

This earlier diagram shows the committed pending state when the capability is installed. It does not represent a production preview or a saved visual decision.

Checks

At c694dff5f8b32b90272121d5fa720f543aeb3e0b, refreshed #417 (c7a7f905383b3638ed9a355729954a8831890d2d) is merged without rewriting #418 or creating a top-layer conflict. Local bun run types, bun run ci, bun run build, and 126 focused tests passed, including the Stop Planner lock regression, preview availability, both channel routes, and editor decisions. Exact-head CI validation, PostgreSQL tests, browser E2E, and container build passed. A focused diff review confirmed the default-off gate and captured-controller cancellation check remain in #418's layer. Two independent reviews passed on the pre-refresh 0655de5d head; this forward parent merge did not change their reviewed request logic.

In an earlier disposable detached integration of pinned #419 with the pre-refresh stack, type and design contract checks, 41 domain/projection tests, 72 PostgreSQL contract tests, and six editor tests passed. Both 017_* migration IDs coexisted in that scratch merge; #419 remains separately owned and unchanged.

The earlier, separately authorized three-turn live acceptance on the pre-gate head recorded two pending requests and one ordinary four-option question. Browser reload and PostgreSQL readback succeeded; a live server or room restart was not tested. The request-domain restart test passed. Chat does not expose token usage. No preview was published. That acceptance demonstrates the request domain, not current production availability.

Stacked on #417. Ready for review; no merge or deploy.