feat(secrets): add entitled_secret_keys to AgentCredential schema

[ptone]

Summary

Adds entitled_secret_keys nullable JSON column to the AgentCredential Ent schema, recording which secret key names a session is entitled to fetch via the future POST /api/v1/agent/secrets endpoint (#127 P2, PR 1 of 3).

• NULL (nil): no entitlement ever recorded - pre-migration credential or a start that failed between token generation and secret resolution. The endpoint must fail closed on NULL with a loud log (a hub bookkeeping error, not an auth failure).
• [] (empty array): entitled to zero secrets - a valid, distinct state.

Migration: existing rows receive NULL, not []

Ent Migrate() uses ALTER TABLE ADD COLUMN entitled_secret_keys TEXT NULL - SQL standard behavior: existing rows receive NULL as the default, not an empty array. Measured:

• The Ent schema uses Optional() which maps to Nullable: true in pkg/ent/migrate/schema.go
• The check() function in the generated create builder does NOT require the field
• CreateAgentCredential (the existing create path) does not set the field -> NULL
• Only UpdateAgentCredentialEntitledKeys sets it -> called after secret resolution

Consequence: pre-migration credentials correctly read as NULL (unknown entitlement / bookkeeping failure), not [] (entitled to nothing). The loud-NULL error fires on these rows if they ever reach the endpoint - which they cannot, because pre-migration tokens lack ScopeAgentSecretFetch.

Design properties

• Session-scoped: each lifecycle event (start/restart) mints a fresh token and credential row. The entitled set is recorded per-credential, not per-agent.
• JTI binding: entitlement is bound to the exact token presented via token_jti_hash.
• Agent-scoped write path: UpdateAgentCredentialEntitledKeys requires both jtiHash and agentID. The store scopes the update to the credential's owning agent, preventing a hash-computation bug from silently writing entitlement onto a different agent's credential.
• Pre-migration rollout guard: pre-migration tokens lack ScopeAgentSecretFetch (PR 3), so NULL rows are unreachable from any token that can call the endpoint.
• Refresh propagation: token refresh creates a new credential row (NULL entitled keys). PR 3 will copy entitled keys from old to new credential during refresh.

Test plan

• set_keys_on_existing_credential
• set_empty_keys (entitled to zero secrets) - verifies empty != nil
• NULL_before_update (pre-migration state) - verifies nil default
• not_found_returns_ErrNotFound_for_unknown_hash
• not_found_returns_ErrNotFound_for_wrong_agent (cross-agent guard) - cross-agent write prevention
• overwrite_existing_keys
• EntitledSecretKeysRoundTrip - full create-update-read with field integrity
• Full go build ./... clean
• Full go test ./pkg/store/entadapter/ suite passes

Part of #127.