Add agent onboarding tokens with Usage-page issuance UI

Per-node onboarding tokens replace the placeholder <token> in the agent
connect command: raw cagt_ tokens are returned once at issuance, only
sha256 hashes persist in agent_auth_tokens, and listing exposes metadata
only. Public agent routes accept env-configured shared tokens or any
active DB-issued token; successful validation stamps last_used_at and
revoked tokens are rejected — verified end-to-end against a real stack
(register, heartbeat, revoke → 401, bogus → 401).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/migrations_goose/20260918000000_agent_auth_tokens.sql

@@ -0,0 +1,20 @@
+-- +goose Up
+-- Per-agent onboarding tokens. Hash (sha256 hex) is stored, never the raw token;
+-- the raw value is shown once at creation time.
+CREATE TABLE IF NOT EXISTS public.agent_auth_tokens (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    token_hash text NOT NULL,
+    label character varying(255) DEFAULT '' NOT NULL,
+    created_at timestamp with time zone DEFAULT now(),
+    last_used_at timestamp with time zone,
+    revoked_at timestamp with time zone,
+    CONSTRAINT agent_auth_tokens_pkey PRIMARY KEY (id),
+    CONSTRAINT agent_auth_tokens_token_hash_key UNIQUE (token_hash)
+);
+
+CREATE INDEX IF NOT EXISTS idx_agent_auth_tokens_active
+    ON public.agent_auth_tokens (token_hash)
+    WHERE revoked_at IS NULL;
+
+-- +goose Down
+DROP TABLE IF EXISTS public.agent_auth_tokens;