refactor: split WebUI gateway dependencies

Maintainer edit for PR 4115: rebase onto origin/main and split gateway HTTP routing from token, media, and workspace services so WebSocketChannel depends on explicit gateway services instead of GatewayHTTPHandler internals.

Preserve file edit channel capabilities and restore tools.restrict_to_workspace wiring through ChannelManager.

nanobot/channels/manager.py

@@ -16,7 +16,6 @@ from nanobot.bus.queue import MessageBus
 from nanobot.channels.base import BaseChannel
 from nanobot.config.schema import Config
 from nanobot.utils.restart import consume_restart_notice_from_env, format_restart_completed_message
-from nanobot.webui.ws_http import GatewayHTTPHandler
 
 if TYPE_CHECKING:
     from nanobot.session.manager import SessionManager
@@ -113,21 +112,24 @@ class ChannelManager:
                 kwargs: dict[str, Any] = {}
                 if cls.name == "websocket":
                     from nanobot.channels.websocket import WebSocketConfig
+                    from nanobot.webui.gateway_services import build_gateway_services
 
                     parsed = WebSocketConfig.model_validate(section)
                     static_path = _default_webui_dist() if self._webui_static_dist else None
                     workspace = Path(self.config.workspace_path)
-                    http_handler = GatewayHTTPHandler(
+                    gateway = build_gateway_services(
                         config=parsed,
+                        bus=self.bus,
                         session_manager=self._session_manager,
                         static_dist_path=static_path,
                         workspace_path=workspace,
+                        default_restrict_to_workspace=self.config.tools.restrict_to_workspace,
                         runtime_model_name=self._webui_runtime_model_name,
                         runtime_surface=self._webui_runtime_surface,
                         runtime_capabilities_overrides=self._webui_runtime_capabilities,
-                        bus=self.bus,
+                        logger=logger,
                     )
-                    kwargs["http_handler"] = http_handler
+                    kwargs["gateway"] = gateway
                 channel = cls(section, self.bus, **kwargs)
                 channel.transcription_provider = transcription_provider
                 channel.transcription_api_key = transcription_key