Add agent onboarding tokens with Usage-page issuance UI

Per-node onboarding tokens replace the placeholder <token> in the agent
connect command: raw cagt_ tokens are returned once at issuance, only
sha256 hashes persist in agent_auth_tokens, and listing exposes metadata
only. Public agent routes accept env-configured shared tokens or any
active DB-issued token; successful validation stamps last_used_at and
revoked tokens are rejected — verified end-to-end against a real stack
(register, heartbeat, revoke → 401, bogus → 401).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/lib/api-client.ts

@@ -883,6 +883,25 @@ export async function listAgents(): Promise<NodeAgentEntity[]> {
   return normalizeAgentArray(payload.agents);
 }
 
+export type AgentAuthToken = components['schemas']['AgentAuthToken'];
+export type AgentAuthTokenCreated = components['schemas']['AgentAuthTokenCreated'];
+
+export async function createAgentToken(label?: string): Promise<AgentAuthTokenCreated> {
+  return requestJson<AgentAuthTokenCreated>(`/agent-tokens`, {
+    method: 'POST',
+    body: JSON.stringify({ label: label ?? '' }),
+  });
+}
+
+export async function listAgentTokens(): Promise<AgentAuthToken[]> {
+  const payload = await requestJson<{ tokens?: AgentAuthToken[] }>(`/agent-tokens`);
+  return payload.tokens ?? [];
+}
+
+export async function revokeAgentToken(id: string): Promise<void> {
+  await requestJson(`/agent-tokens/${id}`, { method: 'DELETE' });
+}
+
 export async function createProject(input: CreateProjectInput): Promise<ProjectEntity> {
   const payload = await requestJson<RawProject | { project?: RawProject }>(`/projects`, {
     method: 'POST',