feat(api): per-agent bearer auth on agent CRUD, conversation, and stream endpoints

- Adds owner_seed_id column to agents table, stamped from instance Ed25519
  seed on agent creation (Path B ownership model)
- Splits routes into public (list/create agents, health) and protected
  (update/delete agent, get conversation, stream messages) with per-agent
  bearer token middleware
- Factors verify_token() helper from existing memory-route middleware;
  adds require_agent_token() and require_conversation_token() wrappers
- RemoteBackend loads per-agent token from disk and sends Authorization
  header on protected requests; ChatState recreates backend with token
  after discovering agent_id

src/api/models.rs

@@ -23,6 +23,9 @@ pub struct AgentState {
     pub memory_blocks: Vec<MemoryBlock>,
     pub tools: Vec<String>,
     pub tags: Vec<String>,
+    /// Public key (hex) of the instance that created this agent.
+    /// `None` for agents created before this field existed.
+    pub owner_seed_id: Option<String>,
     #[serde(rename = "_souveraine")]
     pub souveraine: SouveraineConfig,
 }