Add fake bank website + admin override event subprocesses + manual review

[bastiankoerber]

Summary

Adds a fully local demo experience on top of the existing process:

• bank-website/ — FastAPI backend (port 9400) + vanilla HTML/CSS/JS retail-banking UI with embedded support chat widget. Replaces the hosted chat admin so the demo runs without any cloud dependency. Includes an /admin page that lists active banking-support-agent instances and lets an operator flag fraud or block a customer (publishes a Camunda message).
• Two new event subprocesses inside AI_CustomerSupportAgent ad-hoc: Activity_1n42ugn (Fraud Alert) and EventSubProc_BlockCustomer. Both non-interrupting message-start, both throw escalations that are caught by interrupting boundary events on the ad-hoc.
• Two escalation chains at process root:
  • Escalation_AdminOverride (fraud) → Task_ReviewAdminOverride (user task + new Form_ReviewOverride.form) → exclusive gateway → approve terminate-end or reverse path that calls MCP unfreeze_account + sends apology to the customer.
  • Escalation_CustomerBlocked (block) → terminate-end directly (no review, irreversible).
• Form_ReviewOverride.form — Camunda Form rendered by Tasklist for the reviewer.
• Hardcoded customer Bernd Ruecker (id 42) in the chat-start ioMapping so chat-driven instances have the same supportCase shape as email-driven ones.
• Stubs for missing local credentials: Task_LoadCustomerMasterData (Postgres) → noop, loan-agent JDBC + vector-DB tasks → noop returning [], model bumped to us.anthropic.claude-sonnet-4-5-20250929-v1:0 inference profile, topP removed, applause user task removed from account-support-agent, MCP element template upgraded to schema v0@2 for c8run 8.9 compatibility.
• New mock_mcp_server.py under python-agents/account-management-mcp/ using the official mcp Python SDK (FastMCP) — emits the spec-correct relative endpoint that Camunda's MCP client expects. Adds new tool block_customer(customer_id) that blocks all products.
• Local URL swap for chat reply: apiBaseUrl → http://localhost:9400/api/ across banking-support-agent.bpmn, customer-communication-information.bpmn, customer-communication-question.bpmn.
• .gitignore — exclude .venv/.

See bank-website/README.md for the architecture diagram, prerequisites, three-terminal start procedure, and sample queries.

Test plan

• python3.12 -m venv .venv && .venv/bin/pip install fastapi 'uvicorn[standard]' httpx sse-starlette inside bank-website/, then .venv/bin/python main.py.
• python3.12 -m venv .venv && .venv/bin/pip install mcp 'uvicorn[standard]' inside python-agents/account-management-mcp/, then .venv/bin/python mock_mcp_server.py.
• cd a2a-connector && mvn -B -q package && java -jar target/*.jar.
• Export Bedrock secrets as SECRET_AWS_BEDROCK_ACCESS_KEY + SECRET_AWS_BEDROCK_SECRET_KEY and start c8run.
• c8ctl deploy camunda-solution/*.bpmn camunda-solution/*.form.
• Browser: open http://localhost:9400/, click the chat bubble, type "What are my account details?" — expect agent reply with Bernd's accounts via MCP.
• Open http://localhost:9400/admin in another tab. Click 🚨 Flag fraud on the active conversation. Expect:
  • Customer chat shows a red-bordered Security message
  • localhost:8080/tasklist (demo/demo) gets a new "Review admin override" task
  • Completing with "Approve termination" → process state COMPLETED
  • Completing with "Reverse" → MCP unfreeze_account runs + apology message arrives in chat
• Click 🚫 Block customer. Expect immediate block_customer(42) MCP call (freezes CHK + SAV + CC) + harsher compliance message + process state COMPLETED, no user task.
• Refresh localhost:9400/. Previous conversation persists (conversationUUID in localStorage).

🤖 Generated with Claude Code