Add agent onboarding tokens with Usage-page issuance UI

Per-node onboarding tokens replace the placeholder <token> in the agent
connect command: raw cagt_ tokens are returned once at issuance, only
sha256 hashes persist in agent_auth_tokens, and listing exposes metadata
only. Public agent routes accept env-configured shared tokens or any
active DB-issued token; successful validation stamps last_used_at and
revoked tokens are rejected — verified end-to-end against a real stack
(register, heartbeat, revoke → 401, bogus → 401).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -821,6 +821,82 @@ paths:
               schema:
                 $ref: '#/components/schemas/DeployTemplateResponse'
 
+  # Agent Onboarding Tokens
+  /agent-tokens:
+    post:
+      tags:
+        - Agents
+      summary: Issue agent onboarding token
+      description: Generates a new agent onboarding token. The raw token is returned once and never stored — only its SHA-256 hash persists.
+      security:
+        - bearerAuth: []
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/CreateAgentTokenRequest'
+      responses:
+        '201':
+          description: Token issued; raw value returned once
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentAuthTokenCreated'
+    get:
+      tags:
+        - Agents
+      summary: List agent onboarding tokens
+      description: Returns issued onboarding token metadata (never token values or hashes).
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Token list
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  tokens:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/AgentAuthToken'
+
+  /agent-tokens/{id}:
+    delete:
+      tags:
+        - Agents
+      summary: Revoke agent onboarding token
+      description: Marks a token as revoked. Agents presenting it are rejected from then on.
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+            format: uuid
+      responses:
+        '200':
+          description: Token revoked
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status:
+                    type: string
+                  id:
+                    type: string
+        '404':
+          description: Token not found
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+
   # Audit Logs
   /audit-logs:
     get:
@@ -5507,6 +5583,49 @@ components:
           type: string
           format: date-time
 
+    AgentAuthToken:
+      type: object
+      properties:
+        id:
+          type: string
+          format: uuid
+        label:
+          type: string
+        created_at:
+          type: string
+          format: date-time
+        last_used_at:
+          type: string
+          format: date-time
+        revoked:
+          type: boolean
+        revoked_at:
+          type: string
+          format: date-time
+      required:
+        - id
+        - label
+        - created_at
+        - revoked
+
+    AgentAuthTokenCreated:
+      allOf:
+        - $ref: '#/components/schemas/AgentAuthToken'
+        - type: object
+          properties:
+            token:
+              type: string
+              description: Raw token value, returned exactly once at creation
+          required:
+            - token
+
+    CreateAgentTokenRequest:
+      type: object
+      properties:
+        label:
+          type: string
+          description: Human-readable label for the token (e.g. node name)
+
     AgentCapabilities:
       type: object
       properties: