Chat/agent: route community questions to Nest APIs (do not rebuild chapters/events)

Parent: https://github.com/OWASP/OpenCRE/issues/1072

cc @arkid15r

What

OpenCRE chat (and any future OWASP Agent / MCP ask router) must treat community/logistics questions as Nest’s job.

When the user asks about chapters, events, contributing, GSoC, project directory, or members, call Nest REST instead of retrieving CRE nodes.

Nest APIs to consume (already public)

Base: https://nest.owasp.org/api/v0/ (API key + OpenAPI at /api/v0/docs).

Minimum:

• GET /chapters (geo/country filters exist)
• GET /events
• GET /projects
• GET /issues (contribute)
• optionally GET /members, GET /committees

Do not scrape Meetup or clone Nest’s chapter map. Nest already has proximity.

Expected behaviour

1. Intent router: community | knowledge | unknown.
2. Community → Nest; knowledge → existing CRE/chat path; unknown → ask a clarifying question or try knowledge with a low-confidence disclaimer.
3. Answers that used Nest must cite nest.owasp.org (chapter/event/project URL), same as we cite CRE for knowledge.
4. Failures (Nest 5xx / timeout) are explicit, not silent CRE fallback that looks like a meeting answer.

Success criteria

• Automated tests for at least: chapter/event query hits Nest client (not CRE embeddings); password-storage query does not call Nest chapters.
• Document Nest API key env var; do not commit secrets.
• make lint / make mypy / targeted tests green.

Constraints

• No new Python dependencies unless approved.
• Do not compute gap analysis on Heroku.
• Nest API key is a Nest-side credential; store like other third-party keys.

Out of scope

• Nest MCP (that is Nest’s ticket).
• Changing NestBot.

The issue names no repository files. Start by locating the existing CRE/chat path and its intent-routing entry point, then review the Nest REST endpoints and API-key configuration described here. Done means community queries use Nest with citations and explicit failures, knowledge queries avoid Nest, tests cover both paths, and make lint, make mypy, and targeted tests pass.