fix(issues): decode HTML entities in @mention tokens instead of stripping

Addresses Greptile review on PR #1363: numeric entities decode via
code points; named entities use a small allowlist (amp, nbsp, etc.)
so M&M resolves correctly; unknown named entities are preserved.

Adds mid-token tests for & in agent names.

Made-with: Cursor

server/src/__tests__/normalize-agent-mention-token.test.ts

@@ -14,6 +14,11 @@ describe("normalizeAgentMentionToken", () => {
     expect(normalizeAgentMentionToken("Baba ")).toBe("Baba");
   });
 
+  it("decodes named entities mid-token so agent names can include &", () => {
+    expect(normalizeAgentMentionToken("Ba&ba")).toBe("Ba&ba");
+    expect(normalizeAgentMentionToken("M&M")).toBe("M&M");
+  });
+
   it("returns plain names unchanged", () => {
     expect(normalizeAgentMentionToken("Baba")).toBe("Baba");
   });