feat(support): <Support mode="ops"> inline ops dispute panel + customer p2p_tag banner

[gitchadd]

Adds ops mode to the <Support> widget for the D-027-v2 embedded ops-chat integration.

What changed

• <Support> gains mode (customer|ops), layout (modal|inline|side-rail), onChatResolved; originApp optional.
• New OpsSupportPanel (status pill + P2P tag dropdown, optimistic message list, Send + Resolve), ops bridge client, tab-scoped sessionStorage cache (7-day TTL, flight-guarded).
• Customer-side friendlyP2PTagCopy + P2PTagBanner (wired into the default smart layout); resolved status locks input.
• Version 1.2.0-bridge-ops (dist-tag bridge).

Verification

• tsc --noEmit clean; tests 86 core + 105 vitest; tsup build emits dist/support.* with ops types.

Pairs with the bridge PR (support repo) and the ops-app PR (to follow). Draft until E2E + publish complete.

[gitchadd]

Superseded by the v3 support direction. Operators will connect directly to native Chatwoot via per-ops agent accounts and a thin SSO credential-broker (support#21, D-031–D-034), rather than through an embedded <Support mode="ops"> panel.

The four review findings on this branch (auto-sign on mount, signer-identity effect thrashing, role-blind 403 loop, missing 401 backoff) are all valid against the code, but the code is on the deprecated D-027-v2 embedded path. The customer/merchant <Support> widget is unaffected; only the mode="ops" panel is retired. Closing.

[gitchadd]

Revived and rebased onto main@1.2.1 (was based on v1.1.2 / 1.2.0-bridge-ops).

Context. The editable-CE re-evaluation (two multi-agent deep-dives) reconfirmed this inline-panel-over-the-bridge-/ops/*-proxy approach as the production ops dispute-chat surface: the bridge holds the Chatwoot token server-side, so no token ships to the browser, with no CORS and no iframe. It closes the path to ops-app #314 (the VITE_CHATWOOT_AGENT_TOKEN browser leak), which the companion ops-app change consumes.

Rebase integration. Only conflict was the package.json version (took main 1.2.1). One integration fix: signInWithBridge now mandates signer.getChainId (the multisig sign-in contract that landed on main). Production adapters (privy, thirdweb) already supply it, so only the two ops mock signers needed updating.

Gate. npm run verify green: 130/130 tests, typecheck + examples + build clean.