fix: enforceable Agent writes plus non-blocking save bubbles

[venkateshsakamuri-lab]

Problem

Agent chat answered a metric, then offered “Should I save this as a shared DeepSQL brain note?” A user without canManageContent clicked Yes and got a 403. The offer itself is the bug.

Admins still need a way to persist a useful definition — without the Agent asking, without blocking chat, and without creating a second note that overlaps an existing brain note or business rule. Chips must stay quiet when the Agent already got it right.

Fix

Capability gating

• Stamp callerCapabilities (including doNotOffer and canWriteSharedBrainNotes) on get_brain_context, list_connections, list_brain_recommendations, and get_current_user.
• save_brain_note fail-closes before POST /brain/notes when canManageContent is false.
• SOUL.md / bi-query skill: never volunteer a write listed in doNotOffer.

Suggestion bubbles — only after correction or teaching

• A clean first-turn answer never gets a chip, even if it looks like a definition.
• “Thanks, that’s right” after a good answer also stays quiet.
• A chip appears only when the user follows up with a correction/teaching phrase (that's wrong, always filter, remember this, …) after a prior Agent reply.
• Clicking the chip opens an excerpt of the shared brain note that would be created, plus Save to brain / Merge and save.
• Propose/accept never blocks the composer.
• One unsaved chip at a time; dismissed/saved targets stay suppressed for the session.
• Overlaps with existing notes or business rules merge into one intent.
• schema.table extraction is a linear scan (no ReDoS regex).

Verify

• cd backend && ./mvnw test -Dtest=BrainNoteIntentServiceTest,BrainControllerAuthorizationSafetyTest
• node --test src/components/AgentChat/shouldOfferBrainSuggestion.test.js src/components/AgentChat/AgentRecommendationBubbles.test.js
• Live POST /brain/notes/propose: first-turn and thanks → 204; correction with priorAnswer → 200 NEW / MERGE

Suggestion chip opens an excerpt of the brain note
After save the chip is gone and the composer stays usable
brain_note_suggestion_bubble.mp4

_{To show artifacts inline, enable in settings.}