Stability and API correctness fixes

[LordKay-sudo]

Problem

There are a couple of API correctness issues that can lead to runtime failures or degraded responses:

• /api/ask can fail because user_id is referenced before assignment.
• ask_internal() clears sources after orchestration, so any returned citations/tool sources are dropped.

Scope

Track a focused set of fixes as small, reviewable PRs:

• PR 1: fix undefined user_id in /api/ask and preserve sources returned by orchestration
• PR 2: tighten request validation and return consistent API error responses
• PR 3: harden conversation event parsing and improve diagnostic logging

Why this matters

These changes improve correctness and reliability while keeping risk low by scoping each PR to one concern.