feat(nano): serve/web gateway carries nano — --nano flag + wire surfaces

[agentforce314]

Backend half of the web-UI ↔ nano integration. clawcodex serve and clawcodex web gain --nano, wiring the pi-shaped minimal profile (docs/nano.md) into the browser/desktop gateway the same way the TUI launcher wires it into its agent-server child.

• serve_cli parses --nano into AgentServerConfig, so every session the gateway spawns builds the nano registry + prompt in _build_runtime — including sessions created with the composer's own provider/model (spawn_for's dataclasses.replace keeps the field). It also sets the process-global before the server starts: sessions spawn lazily, and /api/status has to tell the truth with no session in existence.
• web_cli forwards --nano in _serve_argv (web stays a thin wrapper over serve).
• /api/status reports nano — the one pre-session surface the web client's welcome screen can read.
• session.info stamps nano on both publish paths: _init_session_info (strict is True, always stamped, so an older agent's frame reads as not-nano rather than unknown) and publish_session_info (from get_settings, so a client doing full replaces keeps the chip across model switches and turn ends).
• The agent's get_settings reply gains "nano": is_nano_mode() — the same live process-global the init frame reports.

Tests: 10 new in tests/nano/test_nano_web.py — web argv forwarding, serve argparse → config + process-global (both directions), spawn_for override retention, /api/status true/false, strict session.info mapping (init + model-switch republish, via a nano-reporting FakeAgent and the stock one), and get_settings on the real _AgentSession harness. Existing web-cli argv tests extended with the new flag.

Full local suite: 10,333 passed; the only failure is the known dirty-tree test_pip_install_editable timeout (environment-dependent, passes in a clean worktree).

Client half (the badge) follows in the next PR.

🤖 Generated with Claude Code