refactor: split WebUI gateway dependencies

Maintainer edit for PR 4115: rebase onto origin/main and split gateway HTTP routing from token, media, and workspace services so WebSocketChannel depends on explicit gateway services instead of GatewayHTTPHandler internals.

Preserve file edit channel capabilities and restore tools.restrict_to_workspace wiring through ChannelManager.

tests/channels/test_websocket_envelope_media.py

@@ -21,7 +21,7 @@ from nanobot.channels.websocket import (
     WebSocketConfig,
     _extract_data_url_mime,
 )
-from nanobot.webui.ws_http import GatewayHTTPHandler
+from nanobot.webui.gateway_services import build_gateway_services
 
 
 def _tiny_png_data_url() -> str:
@@ -45,17 +45,18 @@ def _make_channel() -> WebSocketChannel:
     bus.publish_inbound = AsyncMock()
     cfg = {"enabled": True, "allowFrom": ["*"], "websocketRequiresToken": False}
     parsed = WebSocketConfig.model_validate(cfg)
-    handler = GatewayHTTPHandler(
+    gateway = build_gateway_services(
         config=parsed,
+        bus=bus,
         session_manager=None,
         static_dist_path=None,
         workspace_path=Path.cwd(),
+        default_restrict_to_workspace=False,
         runtime_model_name=None,
         runtime_surface="browser",
         runtime_capabilities_overrides=None,
-        bus=bus,
     )
-    channel = WebSocketChannel(cfg, bus, http_handler=handler)
+    channel = WebSocketChannel(cfg, bus, gateway=gateway)
     channel._handle_message = AsyncMock()  # type: ignore[method-assign]
     return channel