bug(server-https): citations from follow-up tool calls are silently discarded

## Bug Description

Citations collected during follow-up tool calls in `server-https/app.py` are silently discarded and never returned to the client.

## Root Cause

`stream_llm_response` initializes a fresh `citations_collector = []` on every invocation:
```python
async def stream_llm_response(payload, _depth=0):
citations_collector = [] # brand new list on every call
```

When `handle_tool_follow_up` calls `stream_llm_response` recursively for multi-hop queries, the inner call creates its own isolated `citations_collector`. Any citations found during that inner call are collected into this new list — which is then thrown away when the inner call returns. Only the outermost call's citations are ever sent to the client.

## Impact

In a multi-hop agentic query where the agent calls the search tool twice, the user receives citations only from the first tool call. Citations from all subsequent hops are silently lost, breaking source attribution — a core feature of the RAG system.

## Example Failure Scenario

1. User asks a complex multi-hop Kubeflow question
2. Agent calls `search_kubeflow_docs` → citations collected in outer list ✅
3. Agent calls `search_kubeflow_docs` again in follow-up → citations collected in **inner** `citations_collector` ❌
4. Inner list discarded on return
5. User sees only citations from step 2 — step 3 citations are gone

## Proposed Fix

Pass `citations_collector` as a parameter into `stream_llm_response` so all recursive calls share the same list, or return citations from inner calls and merge them into the outer collector.

I will submit a PR with this fix.