Default thinking level for new sessions, and move the rigs out of AGENTS.md

`Config::default_effort` is what a session starts at when nothing chose one,
applied in `spawn_session` rather than filled in by the spawn screen so it
holds for an import and a bare API call too. It is set by the spawn screen's
own picker, whose label says so: one control, where new sessions are made,
rather than a settings page for a single value. Not on a provider, because
providers are discovered and the next rediscovery would erase it; not on the
phone, because a second device would then spawn at a level nobody there
chose. `GET`/`POST /defaults` carry it as a struct, so the permission mode --
still hardcoded to `auto` on the spawn screen -- can move there later without
a second route.

Only drivers that read a level are given one: an echo session was storing a
`--effort` it never passes to anything, which is a config file answering a
question about itself wrongly.

Separately, `AGENTS.md` is 35 KB sent with every request in this repo, and 12
KB of it was rigs and reference measurements that only matter once you are
running one. Those are the `ai-app-rigs` skill now -- the same text, still the
only copy, read when the work touches it. 35,198 -> 20,813 chars.

Verified on the emulator against the sandbox: the spawn screen pre-fills from
the server, picking `low` spawned a session at `low` and left `/defaults` set
to it, and an echo session spawned afterwards took no level at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/routes.rs

@@ -54,6 +54,8 @@
 //! POST   /sessions/{id}/notify         {notify}  -- announce this one or not
 //! GET    /notifications                SSE: every session's attention-wanting
 //!                                      moments, live only (see `notifications`)
+//! GET    /defaults                    {effort} -- what a new session starts at
+//! POST   /defaults                    {effort} -- null for the CLI's own default
 //! GET    /usage                        cached usage windows per provider
 //! GET    /models                       downloaded GGUFs, and what is being fetched
 //! GET    /models/search?q=Q            HuggingFace repositories matching Q
@@ -137,6 +139,7 @@ pub fn router(manager: Arc<SessionManager>) -> Router {
         .route("/sessions/{id}/model", post(set_model))
         .route("/sessions/{id}/permission-mode", post(set_permission_mode))
         .route("/sessions/{id}/effort", post(set_effort))
+        .route("/defaults", get(defaults).post(set_defaults))
         .route("/sessions/{id}/notify", post(set_notify))
         .route("/notifications", get(notifications))
         .route("/sessions/{id}/compact", post(compact))
@@ -1355,6 +1358,36 @@ struct PermissionModeRequest {
     mode: String,
 }
 
+/// What new sessions start at. One field today; a struct rather than a bare
+/// value because "the defaults" is the thing a phone asks for, and the next
+/// one to move here -- the permission mode, which the spawn screen still
+/// hardcodes -- must not need a second route.
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+struct Defaults {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    effort: Option<String>,
+}
+
+async fn defaults(State(manager): State<Arc<SessionManager>>) -> axum::Json<Defaults> {
+    axum::Json(Defaults {
+        effort: manager.default_effort(),
+    })
+}
+
+/// Sets what a new session's thinking level is. Applied when a session is
+/// spawned, so nothing already running changes underneath anybody.
+async fn set_defaults(
+    State(manager): State<Arc<SessionManager>>,
+    axum::Json(body): axum::Json<Defaults>,
+) -> Result<StatusCode, ApiError> {
+    manager
+        .set_default_effort(body.effort.as_deref())
+        .map_err(bad_request)?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 #[serde(deny_unknown_fields)]