refactor composer to use sqlalchemy, avoid string concatenations and follow conventions

api/main.py

@@ -5,6 +5,7 @@ Endpoints:
     POST /ask                     — submit a question, returns run_id
     GET  /runs/{run_id}/stream    — SSE stream of run events
     GET  /runs/{run_id}           — final state snapshot
+    GET  /runs/{run_id}/log       — JSONL transcript (every published event)
 """
 
 from __future__ import annotations
@@ -17,7 +18,7 @@ from datetime import datetime, timezone
 
 from fastapi import FastAPI, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import StreamingResponse
+from fastapi.responses import FileResponse, StreamingResponse
 from pydantic import BaseModel
 
 from api.runtime import events
@@ -116,3 +117,13 @@ async def stream_run(run_id: str):
     if run_id not in runs:
         raise HTTPException(404, detail=f"Run {run_id} not found")
     return StreamingResponse(events.stream(run_id), media_type="text/event-stream")
+
+
+@app.get("/runs/{run_id}/log")
+async def get_run_log(run_id: str):
+    """Serve the JSONL transcript written by `events.publish`. Available even
+    for in-flight runs (the file is flushed after every write)."""
+    path = events.log_path(run_id)
+    if not path.exists():
+        raise HTTPException(404, detail=f"No log file for run {run_id}")
+    return FileResponse(path, media_type="application/x-ndjson", filename=path.name)