feat(rlm): add LLM bridge for VM-to-host communication

Implements HTTP endpoint for recursive LLM queries from VMs:
- Session token validation via X-Session-Token header
- Single query endpoint with budget tracking
- Batched query support with concurrent execution
- Budget consumption tracking (tokens, time, recursion)
- Add InvalidSessionToken and BatchSizeTooLarge error variants

All 43 tests passing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: AlexMikhalev

crates/terraphim_rlm/src/error.rs

@@ -134,6 +134,14 @@ pub enum RlmError {
     #[error("LLM bridge authentication failed: invalid session token")]
     LlmBridgeAuthFailed,
 
+    /// Invalid session token format.
+    #[error("Invalid session token: {token}")]
+    InvalidSessionToken { token: String },
+
+    /// Batch query size too large.
+    #[error("Batch size {size} exceeds maximum {max}")]
+    BatchSizeTooLarge { size: usize, max: usize },
+
     // Output errors
     /// Output too large for inline return.
     #[error("Output exceeds inline limit ({size} > {limit} bytes), streamed to {file_path}")]

crates/terraphim_rlm/src/lib.rs

@@ -54,6 +54,7 @@ pub mod executor;
 
 // Session and budget management (Phase 2)
 pub mod budget;
+pub mod llm_bridge;
 pub mod session;
 
 // RLM orchestration (to be implemented in later phases)
@@ -62,7 +63,6 @@ pub mod session;
 // pub mod validator;
 // pub mod command;
 // pub mod preamble;
-// pub mod llm_bridge;
 // pub mod logger;
 // pub mod autoscaler;
 // pub mod dns_security;
@@ -77,6 +77,7 @@ pub use executor::{
     Capability, ExecutionContext, ExecutionEnvironment, ExecutionResult, SnapshotId,
     ValidationResult,
 };
+pub use llm_bridge::{LlmBridge, LlmBridgeConfig, QueryRequest, QueryResponse};
 pub use session::{SessionManager, SessionStats};
 pub use types::{
     BudgetStatus, Command, CommandHistory, QueryMetadata, SessionId, SessionInfo, SessionState,