refactor: worker mode — server offloads all LLM/exec to worker

- Split into `tori server` / `tori worker` subcommands (clap derive)
- Extract lib.rs for shared crate (agent, llm, exec, state, etc.)
- Introduce AgentUpdate channel to decouple agent loop from DB/broadcast
- New sink.rs: AgentUpdate enum + ServiceManager + handle_agent_updates
- New worker_runner.rs: connects to server WS, runs full agent loop
- Expand worker protocol: ServerToWorker (workflow_assign, comment)
  and WorkerToServer (register, result, update)
- Remove LLM from title generation (heuristic) and template selection
  (must be explicit)
- Remove KB tools (kb_search, kb_read) and remote worker tools
  (list_workers, execute_on_worker) from agent loop
- run_agent_loop/run_step_loop now take mpsc::Sender<AgentUpdate>
  instead of direct DB pool + broadcast sender

src/lib.rs

@@ -0,0 +1,74 @@
+pub mod api;
+pub mod agent;
+pub mod db;
+pub mod kb;
+pub mod llm;
+pub mod exec;
+pub mod state;
+pub mod template;
+pub mod timer;
+pub mod tools;
+pub mod worker;
+pub mod sink;
+pub mod worker_runner;
+pub mod ws;
+pub mod ws_worker;
+
+use std::sync::Arc;
+use serde::Deserialize;
+
+pub struct AppState {
+    pub db: db::Database,
+    pub config: Config,
+    pub agent_mgr: Arc<agent::AgentManager>,
+    pub kb: Option<Arc<kb::KbManager>>,
+    pub obj_root: String,
+    pub auth: Option<api::auth::AuthConfig>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Config {
+    pub llm: LlmConfig,
+    pub server: ServerConfig,
+    pub database: DatabaseConfig,
+    #[serde(default)]
+    pub template_repo: Option<TemplateRepoConfig>,
+    /// Path to EC private key PEM file for JWT signing
+    #[serde(default)]
+    pub jwt_private_key: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct TemplateRepoConfig {
+    pub gitea_url: String,
+    pub owner: String,
+    pub repo: String,
+    #[serde(default = "default_repo_path")]
+    pub local_path: String,
+}
+
+fn default_repo_path() -> String {
+    if std::path::Path::new("/app/oseng-templates").is_dir() {
+        "/app/oseng-templates".to_string()
+    } else {
+        "oseng-templates".to_string()
+    }
+}
+
+#[derive(Debug, Clone, serde::Serialize, Deserialize)]
+pub struct LlmConfig {
+    pub base_url: String,
+    pub api_key: String,
+    pub model: String,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ServerConfig {
+    pub host: String,
+    pub port: u16,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct DatabaseConfig {
+    pub path: String,
+}