Add administrator onboarding and Agent API key management

[SaladDay]

New installations now open a guided administrator console: register the sole Web account, create and save an Agent API key, optionally connect a host, and generate a real Agent request from a detailed configuration form. The page recognizes the matching Agent and opens it directly. The introduction supports Chinese/English, both themes, reduced motion, skipping and replay.

The console retains legacy Basic authentication for existing deployments. New caller keys are separate from Web passwords and model credentials, returned once, stored as digests in Core, bound to the configured principal and revocable. External bearer requests pass through unchanged. Web-only deployments without key-management authority can continue with their existing caller key. Generated examples refuse redirects and never embed secrets.

Validation:

• Real PostgreSQL and HTTP acceptance: console registration/login, key issue, externally generated request, matching Agent display, actual Core/console process restart, and key revocation.
• Core/console race tests, installer tests, regenerated OpenAPI/sqlc, TypeScript/build/unit checks, 765 Web unit tests and all 12 onboarding browser scenarios.
• make check: 131 browser tests passed; four existing Dashboard failures reproduced unchanged on clean baseline e1970fd. Remaining check targets passed separately. No Dashboard behavior was changed to mask these failures.

This qualifies Agent creation and authentication, not model execution. Existing provider/harness/public resource behavior remains unchanged.

Fresh independent blind review completed with no remaining actionable findings.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}