Stability and API correctness fixes

## Problem
There are a couple of API correctness issues that can lead to runtime failures or degraded responses:

- `/api/ask` can fail because `user_id` is referenced before assignment.
- `ask_internal()` clears `sources` after orchestration, so any returned citations/tool sources are dropped.

## Scope
Track a focused set of fixes as small, reviewable PRs:

- [ ] PR 1: fix undefined `user_id` in `/api/ask` and preserve `sources` returned by orchestration
- [ ] PR 2: tighten request validation and return consistent API error responses
- [ ] PR 3: harden conversation event parsing and improve diagnostic logging

## Why this matters
These changes improve correctness and reliability while keeping risk low by scoping each PR to one concern.