emileriksenkeev links Syd's legal AI with a finance counterpart

Bry (the finance AI in Finance OS) asks Syd legal questions; Syd runs its
normal agentic loop headless (documents, wiki, PH law tools) scoped to the
Corporate Structure V2 project and answers with extracted citations.
Auth: shared AGENT_ASK_KEY via x-agent-key (env; 503 when unset). Machine
path runs thinkingEffort low. Instructions in the caller's question are
treated as data.

Requires on the droplet .env: AGENT_ASK_KEY=<shared secret>
Optional: AGENT_ASK_PROJECT (defaults to 'Corporate Structure V2')

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Syd's agent loop runs 1-2 min headless, but api-legal.rxventures.co is fronted by
Cloudflare, whose 120s edge Proxy-Read-Timeout kills the connection with Error 524
before Syd finishes - Bry's ask_syd hop then reports "Syd answered 524". The zone is
Free-plan and api-legal is a cloudflared tunnel, so the timeout can't be raised and
grey-clouding isn't available.

Cloudflare resets that read timeout on every byte from the origin, so trickle a
whitespace keepalive to the client while the loop runs, then send the JSON at the end.
JSON.parse ignores leading whitespace, so Bry's `await res.json()` parses it unchanged
- no Finance OS change needed. Lazy by design: only streams if the work passes ~90s,
so fast responses and errors keep their normal status codes. Calls res.flush() after
each write because the app gzips JSON (compression middleware would otherwise buffer
the keepalive, same reason the SSE path skips compression).

Keeps the cloudflared tunnel and CF WAF intact - no droplet exposure, no plan upgrade.
Deploy: git pull && npm --prefix backend run build && restart node dist/index.js.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Lands the pending work built in the finance-os sessions on 2026-07-16:

- lib/bryBridge.ts: ask_bry (POST ${BRY_AGENT_URL}/api/bry/ask, shared
  AGENT_ASK_KEY, depth guard - Bry strips its own ask_syd at depth>=1)
  plus list/search/read_bry_documents direct reads of Finance OS's
  document register. Wired into global and project chat only;
  routes/agentAsk.ts deliberately excludes BRY_TOOLS so a Bry-initiated
  hop can never ping-pong back. All fail soft when env is unset.
- xlsx/xls/csv uploads: ALLOWED_TYPES + content types + LibreOffice PDF
  renditions; lib/xlsxText.ts extracts sheet text for chunking/embedding
  (legacy .xls goes through the PDF rendition like .doc).
- .env.example documents the new droplet vars: BRY_AGENT_URL,
  FINANCE_SUPABASE_URL, FINANCE_SUPABASE_KEY.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>