fix(frontend): prevent run creation retries

[Jholly2008]

Why

An initial POST /runs/stream can reach the backend successfully while an intermediary still returns an ambiguous gateway error such as 504. The LangGraph SDK retries failed HTTP requests by default, so retrying this non-idempotent request can create the same run more than once and duplicate user-visible work.

What changed

• Streamed run creation no longer retries the initial HTTP request after an ambiguous failure.
• Reads and explicit stream joins keep their normal retry behavior.
• An established SSE stream can still recover independently with a GET to the server-provided Location, including its Last-Event-ID cursor.
• Regression tests cover both the ambiguous gateway failure and interrupted SSE recovery paths.

Surface area

• Frontend UI — page / component / setting / interaction under frontend/
• Backend API — endpoint / SSE event / request-response shape under backend/app
• Agents / LangGraph — agent node, graph wiring, langgraph.json, or prompt change
• Sandbox — docker/ or sandboxed execution
• Skills — change under skills/
• Dependencies — new/upgraded entry in backend/pyproject.toml or frontend/package.json (say what it buys us)
• Default behavior change — changes existing behavior without the user opting in (default model, default setting, data shape)
• Docs / tests / CI only — no runtime behavior change

Screenshots / Recording

Not applicable; this change has no visual impact.

Bug fix verification

• Test path that reproduces the bug: frontend/tests/unit/core/api/api-client.test.ts (does not retry run creation after an ambiguous gateway failure).
• Did it go red on main and green on this branch? Yes. With the default SDK client, the mocked 504 was retried and the test received the second response (HTTP 400) instead of preserving the original HTTP 504; on this branch the test passes with exactly one request.
• The same file also verifies that disabling request-level retries does not disable SSE recovery: after an established stream is interrupted, the next request is GET and carries the last event ID.

Validation

• python scripts/pnpm.py format — passed
• python scripts/pnpm.py check — ESLint and TypeScript passed
• python scripts/pnpm.py test — 989 tests passed
• BETTER_AUTH_SECRET=local-dev-secret python scripts/pnpm.py build — passed
• Full Playwright E2E on Windows with 10 workers — 128/130 passed; two unrelated Sidecar timing tests timed out only under the parallel full-suite load and passed individually with one worker.

AI assistance

Tool(s) used: Codex

How you used it: Codex traced the SDK retry behavior, implemented the client-scoped change and regression tests, and ran the validation commands. I reviewed the resulting diff and test coverage.

• I've read and understand every line of this change and take responsibility for it — it's not unreviewed AI output.