feat(#18): PAD read-endpoint — web pane renders live PAD/valence from our affect store (Deliverable 2)

The web persona pane now renders live PAD/valence for Tier-3 agents from our
:8390 affect store, closing the persona-telemetry gap (Worldtree persona_state
404s for Tier-3 per ADR-0009; Tier-3 emits no affect_update SSE).

- provider: non-bifrost GET /affect/state/{agent_id} on the affect-store-owning
  app (add_route — keeps /bifrost/* top-level + op-feed-skipped); explicit
  no_affect_snapshot 404 (never a zeroed PAD); busy_timeout + check_same_thread
  on the connection.
- web: GET /api/affect/{agent_id} proxy — end_user_id server-supplied (never the
  browser), colon-id round-trip, configured RATATOSKR_AFFECT_READ_URL.
- pane: honest affect render (pad + valence + emitted_at, labelled "affect", no
  fabricated Tier-1 fields); explicit empty-state; polls 2s post-turn.

Contract-first (docs/contracts/issues/18.contract.md, Deliverable-2-scoped;
Deliverable 1 / composite endpoint deferred — bifrost-blocked on a public
build_combined_app, WT dispatch confirmed single-endpoint caps-routed).
Heid-code-review panel: 1 INV-001 drift (strip fabricated "neutral") + 4
test-gaps fixed. Live-smoke PROVEN: web->provider->affect.db chain returns real
sindra/vuong PAD; Playwright DOM check confirms the pane render + the fix.

Suite 482 green.

tests/test_web_server.py

@@ -616,13 +616,15 @@ class TestCreateAppShape:
     """create_app FN — route registration + state wiring (contract TESTS)."""
 
     def test_routes_registered(self) -> None:
-        """routes_registered [tracer]: app.routes contains all 9 path patterns."""
+        """routes_registered [tracer]: app.routes contains all path patterns,
+        including the #18 affect-read proxy."""
         from ratatoskr.web.server import create_app
         app = create_app(_mock_client_factory())
         paths = {getattr(r, "path", None) for r in app.routes}
         for expected in (
             "/", "/version", "/api/agents", "/api/sessions",
             "/api/agents/{agent_id}/persona_state",
+            "/api/affect/{agent_id}",
             "/api/turns/{session_id}", "/api/turns/{session_id}/stream",
             "/api/turns/{session_id}/cancel",
         ):
@@ -902,3 +904,117 @@ class TestWebBifrostBind:
         resp = TestClient(app).post("/api/sessions", json={"agent_id": "mimir"})
         assert resp.status_code == 201
         assert "bifrost" not in resp.json()
+
+
+class TestAffectStateEndpoint:
+    """affect_state_endpoint FN — #18 Deliverable 2: web proxy to the provider PAD read."""
+
+    @respx.mock
+    def test_happy_proxies_and_supplies_server_end_user_id(self) -> None:
+        """tracer: GET /api/affect/{id} → proxies to the configured provider read URL,
+        supplying end_user_id SERVER-SIDE (INV-002); colon-id round-trips (INV-008)."""
+        from ratatoskr.web.server import create_app
+
+        snap = {
+            "agent_id": "ratatoskr:sindra",
+            "pad": {"pleasure": 0.15, "arousal": 0.08, "dominance": -0.01},
+            "valence": [{"entity_id": "ratatoskr", "familiarity": 0.59, "regard": 0.15}],
+            "emitted_at": "2026-06-18T15:58:12+00:00",
+        }
+        route = respx.get(url__regex=r"http://prov:8390/affect/state/.+").mock(
+            return_value=httpx.Response(200, json=snap)
+        )
+        app = create_app(
+            _mock_client_factory(),
+            end_user_id="vuong",
+            affect_read_url="http://prov:8390",
+        )
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 200
+        assert resp.json() == snap
+        assert route.calls.last.request.url.params["end_user_id"] == "vuong"
+        # INV-008: the colon-id round-trips into the provider path — whether the wire
+        # keeps %3A or normalizes it, it must unquote back to the exact agent_id.
+        from urllib.parse import unquote
+        seg = str(route.calls.last.request.url).split("/affect/state/")[1].split("?")[0]
+        assert unquote(seg) == "ratatoskr:sindra"
+
+    @respx.mock
+    def test_browser_supplied_end_user_id_is_ignored(self) -> None:
+        """INV-002: a browser-supplied end_user_id query is IGNORED; the server's
+        configured partition is used."""
+        from ratatoskr.web.server import create_app
+
+        route = respx.get(url__regex=r"http://prov:8390/affect/state/.+").mock(
+            return_value=httpx.Response(200, json={"agent_id": "ratatoskr:sindra"})
+        )
+        app = create_app(
+            _mock_client_factory(), end_user_id="vuong", affect_read_url="http://prov:8390"
+        )
+        TestClient(app).get("/api/affect/ratatoskr:sindra?end_user_id=attacker")
+        assert route.calls.last.request.url.params["end_user_id"] == "vuong"
+
+    def test_unconfigured_returns_400(self) -> None:
+        """PRE-001: no affect_read_url → 400 affect_not_configured (no silent attempt)."""
+        from ratatoskr.web.server import create_app
+
+        app = create_app(_mock_client_factory(), end_user_id="vuong")  # no affect_read_url
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 400
+        assert resp.json()["error_code"] == "affect_not_configured"
+
+    def test_no_end_user_configured_returns_400(self) -> None:
+        """PRE-001: affect_read_url set but server end_user_id unset → 400 (INV-003
+        fail-visible, never a silent empty)."""
+        from ratatoskr.web.server import create_app
+
+        app = create_app(_mock_client_factory(), affect_read_url="http://prov:8390")
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 400
+        assert resp.json()["error_code"] == "affect_not_configured"
+
+    @respx.mock
+    def test_provider_unreachable_returns_502(self) -> None:
+        """POST-003: a network error reaching the provider → 502 affect_provider_unreachable."""
+        from ratatoskr.web.server import create_app
+
+        respx.get(url__regex=r"http://prov:8390/affect/state/.+").mock(
+            side_effect=httpx.ConnectError("refused")
+        )
+        app = create_app(
+            _mock_client_factory(), end_user_id="vuong", affect_read_url="http://prov:8390"
+        )
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 502
+        assert resp.json()["error_code"] == "affect_provider_unreachable"
+
+    @respx.mock
+    def test_provider_404_passes_through(self) -> None:
+        """POST-002: provider no_affect_snapshot 404 surfaces to the browser verbatim."""
+        from ratatoskr.web.server import create_app
+
+        respx.get(url__regex=r"http://prov:8390/affect/state/.+").mock(
+            return_value=httpx.Response(404, json={"error_code": "no_affect_snapshot"})
+        )
+        app = create_app(
+            _mock_client_factory(), end_user_id="vuong", affect_read_url="http://prov:8390"
+        )
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 404
+        assert resp.json()["error_code"] == "no_affect_snapshot"
+
+    @respx.mock
+    def test_provider_400_passes_through(self) -> None:
+        """POST-002: a provider 400 (e.g. missing_end_user_id — unreachable in normal
+        flow since the proxy always supplies it) still passes through verbatim."""
+        from ratatoskr.web.server import create_app
+
+        respx.get(url__regex=r"http://prov:8390/affect/state/.+").mock(
+            return_value=httpx.Response(400, json={"error_code": "missing_end_user_id"})
+        )
+        app = create_app(
+            _mock_client_factory(), end_user_id="vuong", affect_read_url="http://prov:8390"
+        )
+        resp = TestClient(app).get("/api/affect/ratatoskr:sindra")
+        assert resp.status_code == 400
+        assert resp.json()["error_code"] == "missing_end_user_id"