Sloth-ninja brings Companies House into JessicaOSS research

Extends the ApiKeyProvider union (backend + frontend), envApiKey
fallback, DB CHECK constraint (via the pre-authorised migration
20260706_add_companies_house_user_api_key_provider.sql), and the
account API-keys page with a new Companies House row, so a Companies
House key can be stored per-user or supplied via COMPANIES_HOUSE_API_KEY.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

New backend/src/lib/companiesHouse.ts: typed client for
api.company-information.service.gov.uk (HTTP Basic auth, company-number
normalisation, in-process token bucket + single-flight de-dupe from the
new generic backend/src/lib/rateLimit.ts, TTL cache, 401/404/429/5xx
error mapping). Errors never include the raw key.

Also stands up the vitest harness upstream never shipped
("vitest": "^3.2.4", vitest.config.ts, `npm test`), with 21 TDD unit
tests covering auth headers, normalisation, rate limiting (fake
timers), caching, single-flight, and error mapping.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

New backend/src/lib/legalSourcesTools/companiesHouseTools.ts:
COMPANIES_HOUSE_TOOLS (search/get_company/get_filing_history in OpenAI
function shape), COMPANIES_HOUSE_SYSTEM_PROMPT, and
executeCompaniesHouseToolCall (get_company batches profile+officers+PSCs
into one payload; officer/PSC failures degrade gracefully).

chatTools.ts: buildSystemPrompt/buildMessages/runLLMStream gain the
ResearchSources-gated seam (companiesHouse flag splices the system
prompt and tool set); runToolCalls gains a companies_house_* branch
mirroring the MCP tool-call pattern (generic tool_start/tool_result SSE
pair) with its own companiesHouseEvents accumulator, pushed into
AssistantEvents so results persist to chat history. chat.ts/
projectChat.ts now derive researchSources/includeResearchTools from
whether a Companies House key is configured (server env or per-user) -
no feature toggle, per docs/MIGRATION_SPEC.md decision 6.3.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- shared/types.ts: companies_house_tool_call AssistantEvent variant
  (mirrors the backend shape, carrying the full get_company payload).
- useAssistantChat.ts: companies_house_tool_start/_result SSE handlers,
  same start/result pairing pattern as the MCP handlers.
- AssistantMessage.tsx: extracted the mcp_tool_call chip markup into a
  shared ToolCallChip component, reused by a new companies_house_tool_call
  branch with human-friendly labels ("Searching Companies House...",
  "Fetching company record...", "Fetching filing history..." plus done-state
  company name/number). Completed get_company chips are clickable.
- CompanyPanel.tsx (new): profile/officers/PSCs from the persisted
  get_company payload, UK date formatting throughout (e.g. "21 February
  2022", never MM/DD/YYYY), link-out to the public Companies House
  register.
- AssistantSidePanel.tsx/ChatView.tsx: new CompanyTab kind (not
  document-backed, deduped by companyNumber rather than documentId) and
  an openCompany helper alongside openCitation/openEditor/openDocument.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four new deterministic cases (not smoke-flagged - smoke stays at 4/5):
officers, PSCs, search, and filing-history lookups against known
companies (ARIA GRACE LAW CIC 13927967, MARKS AND SPENCER P.L.C.
00214436), values verified live 8 July 2026. Skip cleanly when
COMPANIES_HOUSE_API_KEY is unset, per the existing runner behaviour.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md: COMPANIES_HOUSE_API_KEY row moved from "planned" to actual
in the env var registry. BUILD_LOG.md: new entry at the top covering
scope, key changes, verification evidence, and decisions for WS1.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- SectionLabel now matches DocPanel's (no uppercase/tracking-wide) so
  section headings read identically across doc-backed and
  company-backed side-panel tabs.
- Pin the title row / "View on Companies House" link and make only the
  section list scroll, matching DocPanel's fixed-header/scrollable-body
  pattern - keeps the register link reachable with long officer/PSC
  lists.
- Add a "No profile data available." empty state so a get_company
  result with no profile fields doesn't render a blank grid.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>