feat: auto-mode UX — per-mode spinner, round counter, first-time warning (#97)

[VforVitorio]

Summary

Builds on #104's max_rounds safety core with the UX layer that makes the new boundary visible and teachable. This is PR 2 of 2 for #97.

• Per-mode spinner colour — the in-turn spinner tracks the active permission mode (orange=ask, blue=auto, red=strict). New mode_color(mode) accessor in ui/status.py so agent/core.py doesn't reach into the private _MODE_COLORS dict. Applies to both the initial thinking. spinner and the live-updating _keepalive spinner.
• Auto-mode round counter — the spinner label appends · round N/M in auto mode, driven by a new on_round_start callback wired into model.act(). Shown only in auto mode because ask blocks on user approval between tool calls (redraws are rare) and strict has no round concept. Gives real-time visibility into how much of the max_rounds budget the current turn has consumed.
• First-time auto warning — first Tab-cycle into auto in a session prints a one-shot amber hint above the prompt via prompt_toolkit's run_in_terminal, so it lands cleanly without tearing the ghost-text completion layer. Session-scoped via self._auto_warned — never re-prints after cycling away and back. Format: auto mode — tools run without asking, up to N rounds per turn. Ctrl+C stops a running turn.
• /status surfaces max rounds — new row in the session-state table so users can verify which safety boundary is currently in effect (config / env var / --max-rounds CLI flag all funnel into the same value).

Stacked on #104

This PR targets feat/auto-max-rounds (not dev) so the diff shown here is only the UX layer, not PR 1's safety core. Merge #104 into dev first, then re-target this PR to dev (GitHub will auto-rebase the base).

PR 1 (#104) delivers the actual safety guarantee; this PR turns it into something the user can see and learn from.

Implementation notes

• max_prediction_rounds is now computed before asyncio.create_task(_keepalive()) so the closure sees a bound cell when it first runs. Previously it was defined after the task was created — worked by accident because the first await happened after assignment, but fragile.
• The first-time warning uses run_in_terminal rather than a direct console.print because the Tab cycle fires from inside prompt_toolkit's keybinding loop. A direct print would tear the prompt; run_in_terminal temporarily pauses the prompt, writes above it, and restores.
• _print_auto_warning() is a method on Agent rather than a closure so it's unit-testable without prompt_toolkit terminal plumbing.

Tests

• test_run_turn_passes_on_round_start_to_act — verifies the on_round_start kwarg is wired as a callable and accepts a 0-based round index.
• test_agent_auto_warned_initially_false — pins the fresh-agent default.
• test_print_auto_warning_fires_once_per_session — calls the method twice, asserts console.print fires exactly once.
• test_cycle_mode_preserves_always_allowed_tools — regression guard: a future refactor that adds _always_allowed_tools.clear() to the mode handler will be caught.
• test_print_status_includes_max_rounds_line — asserts /status output contains the new row.

Test plan

• uv run ruff check . && uv run ruff format --check . && uv run mypy src/ && uv run pytest — all green (213 passed)
• Manual: uv run lmcode chat, Tab to auto, verify amber warning prints above the prompt once and never again
• Manual: Tab back to ask, spinner becomes orange; Tab to auto, spinner becomes blue; Tab to strict, spinner becomes red
• Manual: in auto mode, send a multi-step request and verify the spinner shows · round 2/10, · round 3/10, …
• Manual: /status shows max rounds 10 (or whatever LMCODE_AGENT__MAX_ROUNDS / --max-rounds sets)

Closes #97 together with #104.