Add agent onboarding tokens with Usage-page issuance UI

Per-node onboarding tokens replace the placeholder <token> in the agent
connect command: raw cagt_ tokens are returned once at issuance, only
sha256 hashes persist in agent_auth_tokens, and listing exposes metadata
only. Public agent routes accept env-configured shared tokens or any
active DB-issued token; successful validation stamps last_used_at and
revoked tokens are rejected — verified end-to-end against a real stack
(register, heartbeat, revoke → 401, bogus → 401).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/sqlc/queries/agent_tokens.sql

@@ -0,0 +1,22 @@
+-- name: CreateAgentAuthToken :one
+INSERT INTO agent_auth_tokens (token_hash, label)
+VALUES ($1, $2)
+RETURNING *;
+
+-- name: ListAgentAuthTokens :many
+SELECT * FROM agent_auth_tokens
+ORDER BY created_at DESC;
+
+-- name: GetActiveAgentAuthTokenByHash :one
+SELECT * FROM agent_auth_tokens
+WHERE token_hash = $1 AND revoked_at IS NULL
+LIMIT 1;
+
+-- name: TouchAgentAuthToken :exec
+UPDATE agent_auth_tokens SET last_used_at = NOW()
+WHERE token_hash = $1 AND revoked_at IS NULL;
+
+-- name: RevokeAgentAuthToken :one
+UPDATE agent_auth_tokens SET revoked_at = NOW()
+WHERE id = $1 AND revoked_at IS NULL
+RETURNING *;