chore(agents): deprecate the legacy Conversation endpoints

[ExtraToast]

Summary

First of three steps to move the renamed Conversation model onto /api/v1/conversations (#68). Marks the six legacy Conversation and Message operations @Deprecated. No behaviour change — the handlers answer exactly as before, and only the spec gains deprecated: true.

This exists because of how the contract gate works. oasdiff raises api-path-removed-without-deprecation when a path vanishes from the spec, but raises nothing when a path already marked deprecated in the base is removed — and the workflow sets no --deprecation-days-*, so the grace period is zero. Deprecating here is what lets step two delete these endpoints cleanly.

Sequence:

1. This PR — deprecate the legacy endpoints.
2. Next — drop the legacy Conversation/Message model and its tables. Passes because the base now marks those paths deprecated.
3. Then — refactor(agents): rename Chat Session to Conversation, drop the legacy model #79 rebased: the rename, the ownership fix from Conversations are readable and writable by any caller who knows the id #80, and the alias. With /api/v1/conversations absent from main, everything it adds there registers as a new path, so its required X-User-Id, nullable title and maxLength: 120 produce no findings.

Validation

• :api:test — 623 tests, 621 passed, 0 failed, 2 pre-existing skips
• :api:integrationTest — 139 tests, 137 passed, 0 failed, 2 skipped
• detekt (main, test, integrationTest) + ktlint --warning-mode=fail — clean
• Spec regenerated and committed; all six operations show deprecated: true
• oasdiff breaking against origin/main — no breaking changes

The mechanic was verified against real oasdiff with purpose-built fixtures before committing to this sequence, rather than inferred from its documentation:

• removing a deprecated: true path → no findings
• removing the same path undeprecated → api-path-removed-without-deprecation
• a brand-new path carrying a required header, a nullable property and a narrower maxLength → no findings

Notes

• Deprecating is deliberately separated from removing. Done in one PR, the base spec would still show the paths live and the removal would be flagged — the base only gains the marker once this lands on main.
• Between step 2 and step 3 landing, /api/v1/conversations is absent from the service. Neither agents-ui nor home-portal calls it — agents-ui uses /api/v1/chat-sessions exclusively — but an undocumented external caller cannot be ruled out from this repo. Worth a glance at real traffic before step 2 merges.
• The alternative was a waiver in api-contract-checks, which was ruled out. This keeps the gate intact and at full strength throughout.

refs #68