feat: Embeddable Chat Widget (#9)

[CIKR-Repos]

Embeddable Chat Widget

Summary

Adds a fully embeddable chat widget that can be integrated into any website via a simple <script> tag. The widget communicates through a sandboxed iframe for security isolation.

What's Included

Backend (Public Widget API)

• GET /api/widget/{projectId}/config — Public endpoint to fetch widget theme/settings (authenticated via API key query param)
• POST /api/widget/{projectId}/chat — Public chat endpoint for widget messages (API key auth)
• GET /api/widget/embed.js — Standalone JavaScript widget loader (creates floating button + iframe)
• GET /api/widget/{projectId}/frame — Sandboxed iframe HTML page with full chat UI
• WidgetConfigRequestValidator — FluentValidation rules: hex color format, valid positions, URL validation, length limits

Frontend (Angular Dashboard)

• Widget Settings Page (/projects/:id/widget) — Full configuration UI built with Tailwind CSS and Angular Signals:
  • Live theme preview with color pickers
  • Position selector (bottom-right / bottom-left)
  • Avatar URL, title, subtitle, placeholder text
  • Allowed origins security configuration
  • Enable/disable toggle
  • Embed code generator with copy-to-clipboard
• Dashboard project cards now show Pipeline and Widget quick-links

Widget Embed Script

The embed script (embed.js) creates:

1. A floating chat button (FAB) with configurable theme color
2. An iframe pointing to the widget frame endpoint
3. sandbox="allow-scripts allow-same-origin allow-forms" for security isolation
4. PostMessage communication between parent and iframe (open/close/theme sync)

Usage

<script>
  window.PipeRAGWidget = {
    projectId: 'your-project-id',
    apiKey: 'your-api-key'
  };
</script>
<script src="https://your-domain/api/widget/embed.js" defer></script>

Tests (20+ new tests)

• WidgetControllerTests — CRUD operations, authorization, partial updates
• PublicWidgetControllerTests — API key validation, config fetching, chat endpoint, embed script generation
• WidgetValidationTests — Color validation, position validation, URL validation, length limits

Other

• Fix pre-existing StripeService build error (Stripe SDK API change for CurrentPeriodStart/End)

Checklist

• Tailwind CSS only (no plain SCSS)
• Angular Signals + standalone components
• 20+ tests passing
• Sandboxed iframe with PostMessage communication
• API key authentication for public endpoints
• Origin allowlist security

[CIKR-Repos]

@copilot please review this PR

[sourcery-ai]

Sorry @CIKR-Repos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[Copilot]

@CIKR-Repos I've opened a new pull request, #14, to work on those changes. Once the pull request is ready, I'll request review from you.

[CIKR-Repos]

Closing: Chat widget already merged in #11. All 10 MVP PRs are complete!