feat(chat): client turn-id makes fire-and-forget bulletproof

Brian fires a quick message then locks his phone to go play the hand — which drops
the SSE stream, and on wake the UI re-fires via the blocking fallback. The prior
(session, message) + 20s window caught the near-simultaneous case but not a re-fire
minutes later.

Now the UI stamps each send with a unique turnId (crypto.randomUUID) and carries the
SAME id on both the stream and the fallback; the server dedupes on it. Bulletproof
regardless of how long he's away — lock for an hour, come back, still exactly one
execution and one log — and a genuinely new send gets a fresh id so nothing legit is
swallowed. Id-keyed turns keep a long (1h) window; requests without an id keep the
short (session, msg) window for near-simultaneous dupes.

Verified end-to-end: two POSTs with the same turnId → one reply, one persisted
exchange pair (the duplicate reused the owner's result). 9 dedup tests; suite 235.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyra/web/server.py

@@ -273,11 +273,13 @@ def create_app() -> FastAPI:
         user_msg = _last_user_message(body.get("messages", []))
 
         model_override = body.get("model") or None
+        turn_id = body.get("turnId") or None
         memory.ensure_session(session_id)
         if body.get("mode"):
             memory.set_session_mode(session_id, body["mode"])
         try:
-            reply = await asyncio.to_thread(chat.respond, session_id, user_msg, backend, model_override)
+            reply = await asyncio.to_thread(chat.respond, session_id, user_msg, backend,
+                                            model_override, turn_id)
         except Exception as exc:
             logbus.log("error", "chat failed", session=session_id, error=str(exc))
             reply = f"[error] {exc}"
@@ -305,6 +307,7 @@ def create_app() -> FastAPI:
         backend = _backend_for(body.get("backend"))
         user_msg = _last_user_message(body.get("messages", []))
         model_override = body.get("model") or None
+        turn_id = body.get("turnId") or None
         memory.ensure_session(session_id)
         if body.get("mode"):
             memory.set_session_mode(session_id, body["mode"])
@@ -316,7 +319,8 @@ def create_app() -> FastAPI:
 
             def produce():
                 try:
-                    for event in chat.respond_stream(session_id, user_msg, backend, model_override):
+                    for event in chat.respond_stream(session_id, user_msg, backend,
+                                                     model_override, turn_id):
                         loop.call_soon_threadsafe(q.put_nowait, event)
                 except Exception as exc:  # surface to the client stream, don't hang
                     logbus.log("error", "chat stream failed", session=session_id, error=str(exc))