Add bnfexpress signed admin client and AI Agent Filament UI

- Modules\Shared\Bnfexpress\BnfexpressAdminClient: HMAC-signed HTTP client
  for bnfexpress's admin API (EV FAQs, agent instructions, chat history),
  with a bnfexpress:smoke-test command and full unit coverage.
- New ai-agent module: Filament pages to manage EV FAQs, publish/roll back
  agent instruction versions, and browse EV chat history + transcripts.
- New manage_ai_agent permission (super_admin/admin).
- Recorded .ai/rules for the client's auth scheme and non-Resource
  Filament page/table testing gotchas.

app/Providers/Filament/AdminPanelProvider.php

@@ -21,6 +21,7 @@ use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;
 use Illuminate\Routing\Middleware\SubstituteBindings;
 use Illuminate\Session\Middleware\StartSession;
 use Illuminate\View\Middleware\ShareErrorsFromSession;
+use Modules\AiAgent\AiAgentPlugin;
 use Modules\Booking\BookingPlugin;
 use Modules\Catalog\CatalogPlugin;
 use Modules\Cms\CmsPlugin;
@@ -51,6 +52,7 @@ class AdminPanelProvider extends PanelProvider
                 NavigationGroup::make()->label('Operations'),
                 NavigationGroup::make()->label('Reports'),
                 NavigationGroup::make()->label('CMS'),
+                NavigationGroup::make()->label('AI Agent'),
             ])
             ->plugins([
                 CatalogPlugin::make(),
@@ -60,6 +62,7 @@ class AdminPanelProvider extends PanelProvider
                 IdentityPlugin::make(),
                 ReportingPlugin::make(),
                 CmsPlugin::make(),
+                AiAgentPlugin::make(),
                 // T6.5 — ops convenience for browsing storage/logs/*.log
                 // in-browser; distinct from the structured, per-model audit
                 // trail (AuditLogResource, T6.2). No extra permission gate: