feat: add conversation export functionality with API and UI integration

[chenyme]

Summary

Add conversation JSON export and consolidate sharing/export actions into a unified “Share & Export” flow.

This change adds an authenticated full-conversation JSON export API, including conversation metadata, messages, runs, token/billing snapshots, attachments snapshots, visible process traces, and default visible message branch IDs. The frontend adds JSON download support and moves scattered share/export actions into a shared “Share & Export” menu across chat header, conversation title menu, sidebar conversation menus, and recent conversation rows.

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• cd backend && go test ./internal/application/conversation ./internal/transport/http/conversation ./internal/infra/persistence/postgres/conversation
• cd backend && make swagger
• cd backend && go test ./...
• cd frontend && pnpm lint
• cd frontend && pnpm build
• git diff --check

Screenshots, API examples, or logs

New API:

GET /api/v1/conversations/{id}/export

Response includes:

{
  "version": 1,
  "exportScope": "full",
  "exportedAt": "...",
  "conversation": {},
  "messages": [],
  "runs": [],
  "totalMessages": 0,
  "totalRuns": 0,
  "defaultMessagePublicIDs": [],
  "compatibility": {
    "format": "deeix.conversation.export",
    "notes": "Full backup export. Import compatibility is not guaranteed."
  }
}

Configuration, migration, and compatibility notes

No configuration or database migration is required.

API change: adds a new authenticated export endpoint. Existing conversation, sharing, message listing, and send-message APIs remain unchanged.

Swagger was regenerated to include the new export response schema.

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.