Update provision.sh to install crimata-agent and fix nginx routing

- Install crimata-agent: npm install + build, crimata-agent.service with
  ANTHROPIC_API_KEY env, started after crimata-dock
- Add 4th arg: ANTHROPIC_API_KEY
- nginx: fix /auth/ prefix stripping (trailing-slash proxy_pass), add /ws
  WebSocket proxy with upgrade headers, /events for server-side event emission,
  /components/ static alias for component HTML fragments

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/compute/provision.sh

@@ -1,12 +1,13 @@
 #!/bin/bash
 # provision.sh — Crimata OS bootstrap
-# Usage: provision.sh <slug> <password> <db_password>
+# Usage: provision.sh <slug> <password> <db_password> <anthropic_api_key>
 
 set -euo pipefail
 
 SLUG=$1
 PASSWORD=$2
 DB_PASSWORD=$3
+ANTHROPIC_API_KEY=${4:-}
 OS_REPO="https://github.com/adgundersen/os"
 
 log() { echo "[crimata] $1"; }
@@ -54,7 +55,15 @@ cd /usr/lib/crimata-contacts
 npm install --silent
 npm run build
 
-# ── 7. Postgres setup ───────────────────────────────────────────────────────
+# ── 7. Install crimata-agent ────────────────────────────────────────────────
+log "Installing crimata-agent..."
+mkdir -p /usr/lib/crimata-agent
+cp -r /tmp/crimata-os/agent/* /usr/lib/crimata-agent/
+cd /usr/lib/crimata-agent
+npm install --silent
+npm run build
+
+# ── 8. Postgres setup ───────────────────────────────────────────────────────
 log "Configuring Postgres..."
 systemctl enable postgresql
 systemctl start postgresql
@@ -68,7 +77,7 @@ su -c "psql -tc \"SELECT 1 FROM pg_database WHERE datname='crimata_contacts'\" |
 DATABASE_URL="postgresql://crimata:$DB_PASSWORD@localhost/crimata_contacts" \
     node /usr/lib/crimata-contacts/dist/migrate.js
 
-# ── 8. systemd units ────────────────────────────────────────────────────────
+# ── 9. systemd units ────────────────────────────────────────────────────────
 log "Installing systemd units..."
 
 cat > /etc/systemd/system/crimata-auth.service << EOF
@@ -112,11 +121,25 @@ Environment=DATABASE_URL=postgresql://crimata:$DB_PASSWORD@localhost/crimata_con
 WantedBy=multi-user.target
 EOF
 
-systemctl daemon-reload
-systemctl enable crimata-auth crimata-dock crimata-contacts
-systemctl start crimata-auth crimata-dock crimata-contacts
+cat > /etc/systemd/system/crimata-agent.service << EOF
+[Unit]
+Description=Crimata Agent
+After=network.target crimata-dock.service
 
-# ── 9. Nginx ────────────────────────────────────────────────────────────────
+[Service]
+ExecStart=node /usr/lib/crimata-agent/dist/index.js
+Restart=always
+Environment=ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable crimata-auth crimata-dock crimata-contacts crimata-agent
+systemctl start  crimata-auth crimata-dock crimata-contacts crimata-agent
+
+# ── 10. Nginx ───────────────────────────────────────────────────────────────
 log "Configuring nginx..."
 
 cat > /etc/nginx/sites-available/crimata << EOF
@@ -127,21 +150,45 @@ server {
     root /opt/crimata/ui;
     index index.html;
 
+    # Static UI
     location / {
         try_files \$uri \$uri/ /index.html;
     }
 
-    location /auth {
-        proxy_pass http://localhost:7700;
+    # Auth service (strips /auth/ prefix → sends bare path to port 7700)
+    location /auth/ {
+        proxy_pass http://localhost:7700/;
     }
 
+    # Dock service
     location /dock/ {
         proxy_pass http://localhost:7701/;
     }
 
+    # Agent WebSocket
+    location /ws {
+        proxy_pass http://localhost:7702/ws;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_read_timeout 3600;
+    }
+
+    # Agent events (for server-side services to emit events)
+    location /events {
+        proxy_pass http://localhost:7702/events;
+    }
+
+    # App: contacts
     location /apps/contacts/ {
         proxy_pass http://localhost:3001/contacts/;
     }
+
+    # UI component files (served statically from /opt/crimata/ui/components/)
+    location /components/ {
+        alias /opt/crimata/ui/components/;
+        add_header Cache-Control "no-cache";
+    }
 }
 EOF
 
@@ -151,7 +198,7 @@ nginx -t
 systemctl enable nginx
 systemctl restart nginx
 
-# ── 10. Cleanup ─────────────────────────────────────────────────────────────
+# ── 11. Cleanup ──────────────────────────────────────────────────────────────
 rm -rf /tmp/crimata-os
 
 log "Done. $SLUG.crimata.com is live."