Eval harness (#62 P4), status frames, and agentic runs (#63) (#71)

## Summary
- Closes Phase 4 of [#62](#62): `evals/suite.json` (≥40 graded questions), `run_evals` management command, and manually-triggered `.gitea/workflows/run-evals.yml`.
- Emits versioned WS `status` frames during grounded chat (evaluating / searching / reading_sources / refining / writing) for [chat_web_app#96](ai_ml_operations/chat_web_app#96).
- Implements [#63](#63): Redis/Celery optional infra, `AgentRun`/`AgentStep`, tool registry (SSRF-safe `fetch_url`, tenant-scoped docs), LangGraph orchestrator, progress frames, REST `GET/POST /api/agent_runs/…`, gated by `ALLOW_AGENTIC_TASKS` (default off).

## Test plan
- [x] `SKIP_RAG_INIT=1 uv run python manage.py test` for evals, ws frames, agent tools, consumers, grounding
- [ ] Manual: with `ALLOW_AGENTIC_TASKS=false`, chat identical to today
- [ ] Manual: status frames visible in FE with #96 branch
- [ ] Manual (GPU): `python manage.py run_evals --runs 3`
- [ ] Manual: `ALLOW_AGENTIC_TASKS=true` multi-step research prompt creates AgentRun + framesReviewed-on: #71

.env.prod.example

@@ -101,6 +101,21 @@ FRONTEND_BASE_URL=https://chat.aimloperations.com
 # STRIPE_CHECKOUT_CANCEL_URL=https://chat.aimloperations.com/billing/cancel
 # STRIPE_PORTAL_RETURN_URL=https://chat.aimloperations.com/account/
 
+# Agentic task execution (#63). Keep false until Redis/Celery worker + Ollama
+# capacity are confirmed on this host; false = identical behavior to #62.
+ALLOW_AGENTIC_TASKS=false
+# Shared Redis (channel layer fan-out across gunicorn/uvicorn workers +
+# Celery broker for agent runs). Point both at the same instance.
+# REDIS_URL=redis://10.0.0.128:6379/0
+# CELERY_BROKER_URL=redis://10.0.0.128:6379/0
+# OLLAMA_MODEL_ORCHESTRATOR=gpt-oss:20b
+# OLLAMA_MODEL_SUBAGENT=llama3.2
+# AGENT_MAX_PLAN_STEPS=8
+# AGENT_MAX_ITERATIONS=12
+# AGENT_WALL_CLOCK_SECONDS=600
+# AGENT_SUBAGENT_CONCURRENCY=3
+# Start the worker (server-infra): docker compose --profile agentic up -d worker
+
 # Gunicorn / ASGI (UvicornWorker for WebSockets)
 GUNICORN_WORKERS=2
 GUNICORN_BIND=0.0.0.0:8000