feat(gateway): PreferencesService + /preferences REST + /system Valkey override (P8-011)

- PreferencesService: platform defaults, user overrides, IMMUTABLE_KEYS enforcement
- PreferencesController: GET /api/preferences, POST /api/preferences, DELETE /api/preferences/:key
- PreferencesModule: global module exporting PreferencesService and SystemOverrideService
- SystemOverrideService: Valkey-backed session-scoped system prompt override with 5-min TTL + renew
- CommandRegistryService: register /system command (socket execution)
- CommandExecutorService: handle /system command via SystemOverrideService
- AgentService: inject system override before each prompt turn, renew TTL; store userId in session
- ChatGateway: pass userId when creating agent sessions
- PreferencesService unit tests: 11 tests covering defaults, overrides, enforcement wins, immutable key errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/gateway/src/commands/command-executor.service.ts

@@ -2,6 +2,7 @@ import { Inject, Injectable, Logger } from '@nestjs/common';
 import type { SlashCommandPayload, SlashCommandResultPayload } from '@mosaic/types';
 import { AgentService } from '../agent/agent.service.js';
 import { CommandRegistryService } from './command-registry.service.js';
+import { SystemOverrideService } from '../preferences/system-override.service.js';
 
 @Injectable()
 export class CommandExecutorService {
@@ -10,6 +11,7 @@ export class CommandExecutorService {
   constructor(
     @Inject(CommandRegistryService) private readonly registry: CommandRegistryService,
     @Inject(AgentService) private readonly agentService: AgentService,
+    @Inject(SystemOverrideService) private readonly systemOverride: SystemOverrideService,
   ) {}
 
   async execute(payload: SlashCommandPayload, _userId: string): Promise<SlashCommandResultPayload> {
@@ -31,6 +33,8 @@ export class CommandExecutorService {
           return await this.handleModel(args ?? null, conversationId);
         case 'thinking':
           return await this.handleThinking(args ?? null, conversationId);
+        case 'system':
+          return await this.handleSystem(args ?? null, conversationId);
         case 'new':
           return {
             command,
@@ -124,4 +128,28 @@ export class CommandExecutorService {
       message: `Thinking level set to "${level}".`,
     };
   }
+
+  private async handleSystem(
+    args: string | null,
+    conversationId: string,
+  ): Promise<SlashCommandResultPayload> {
+    if (!args || args.trim().length === 0) {
+      // Clear the override when called with no args
+      await this.systemOverride.clear(conversationId);
+      return {
+        command: 'system',
+        conversationId,
+        success: true,
+        message: 'Session system prompt override cleared.',
+      };
+    }
+
+    await this.systemOverride.set(conversationId, args.trim());
+    return {
+      command: 'system',
+      conversationId,
+      success: true,
+      message: `Session system prompt override set (expires in 5 minutes of inactivity).`,
+    };
+  }
 }