fix: SSE streaming for no-tool path, batch ticker API, security & cleanup

- Fix thinkAndActStream: emit delta event for non-tool responses (was silent)
- Add fallback to streaming on first LLM call failure
- Add batch ticker endpoint /api/agent/tickers (3 API calls → 1)
- Update MarketTicker to use batch endpoint, remove unused state
- Warn loudly when JWT_SECRET uses default value
- Fix 华为 mapping (was incorrectly mapped to Tencent)
- Replace ioutil.ReadAll with safe.ReadAllLimited in nofxos client
- Remove unused variable in hyperliquid trader_account
- Wrap CoinAnk WS readers with safe.GoNamed for panic recovery
- Use 100dvh for mobile viewport in AgentChatPage
- console.log → console.warn for auth events

api/agent_routes.go

@@ -16,4 +16,5 @@ func (s *Server) RegisterAgentHandler(h *agent.WebHandler) {
 	s.router.GET("/api/agent/health", gin.WrapF(h.HandleHealth))
 	s.router.GET("/api/agent/klines", gin.WrapF(h.HandleKlines))
 	s.router.GET("/api/agent/ticker", gin.WrapF(h.HandleTicker))
+	s.router.GET("/api/agent/tickers", gin.WrapF(h.HandleTickers))
 }