Default thinking level for new sessions, and move the rigs out of AGENTS.md

`Config::default_effort` is what a session starts at when nothing chose one,
applied in `spawn_session` rather than filled in by the spawn screen so it
holds for an import and a bare API call too. It is set by the spawn screen's
own picker, whose label says so: one control, where new sessions are made,
rather than a settings page for a single value. Not on a provider, because
providers are discovered and the next rediscovery would erase it; not on the
phone, because a second device would then spawn at a level nobody there
chose. `GET`/`POST /defaults` carry it as a struct, so the permission mode --
still hardcoded to `auto` on the spawn screen -- can move there later without
a second route.

Only drivers that read a level are given one: an echo session was storing a
`--effort` it never passes to anything, which is a config file answering a
question about itself wrongly.

Separately, `AGENTS.md` is 35 KB sent with every request in this repo, and 12
KB of it was rigs and reference measurements that only matter once you are
running one. Those are the `ai-app-rigs` skill now -- the same text, still the
only copy, read when the work touches it. 35,198 -> 20,813 chars.

Verified on the emulator against the sandbox: the spawn screen pre-fills from
the server, picking `low` spawned a session at `low` and left `/defaults` set
to it, and an echo session spawned afterwards took no level at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/config.rs

@@ -30,6 +30,18 @@ pub struct Config {
     pub tokens: Vec<TokenEntry>,
     pub setups: Vec<SetupConfig>,
     pub sessions: Vec<SessionConfig>,
+    /// What a new session's thinking level is when nothing chose one.
+    ///
+    /// Here rather than on a provider because providers are *discovered*: a
+    /// default written onto one would be erased by the next rediscovery, which
+    /// is the kind of setting that looks like it stuck until the day it did
+    /// not. Here rather than on the phone because a second device would then
+    /// spawn sessions the first one's owner did not expect.
+    ///
+    /// `None` is the CLI's own default, and stays reachable: this is a level
+    /// somebody chose, not a level this app picked for them.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub default_effort: Option<String>,
 }
 
 /// A machine, and the things it can run.
@@ -462,6 +474,7 @@ mod tests {
                     }],
                 },
             ],
+            default_effort: Some("low".to_string()),
             sessions: vec![SessionConfig {
                 id: "abc123".to_string(),
                 setup: "vm".to_string(),