refactor(hub): extract resolveAgentSecrets, return JTI hash from token gen (#127)

[ptone]

Summary

• Extract resolveAgentSecrets as the single source of truth for entitled-set
  computation. Returns both forInjection (filtered by injection mode) and
  entitledKeys (all secret key names from backend resolution). The injection
  mode governs timing, not entitlement.
• AgentTokenGenerator interface returns JTI hash alongside the token string,
  so the dispatcher can bind entitled keys to the correct AgentCredential row.
• recordEntitledKeys helper wired at all three dispatch paths (create, start,
  restart). Best-effort — logs on failure, does not block agent start.
• DispatchAgentResetAuth updated for new return value (no entitled key
  recording — reset-auth does not resolve secrets).
• Legacy resolveSecrets wrapper preserved for call sites that don't need the
  entitled key set.
• 20 test files updated for the new GenerateAgentToken signature
  (token, jtiHash, err).

Depends on

PR #1332 (schema: entitled_secret_keys field + UpdateAgentCredentialEntitledKeys)

Design notes

• Resolver vs chooser separation (Rule 126): This PR moves the resolver.
  PR 3 changes the chooser (entitlement filtering at the secrets endpoint).
  Entitlement filtering is NOT folded into resolveAgentSecrets.
• Three-state model: The credential's entitled_secret_keys column is
  NULL (never recorded), empty (entitled to nothing), or populated.
  resolveAgentSecrets always returns a non-nil slice (may be empty),
  so credentials written via this path will never have NULL.

Test plan

• go build ./... — clean
• Targeted tests pass: TestGenerateAgentToken, TestRefreshAgentToken,
  TestHTTPAgentDispatcher
• Full pkg/hub suite (pre-existing 300s timeout, not caused by these changes)
• Reviewer verifies all three dispatch paths (create, start, restart) record
  entitled keys after token generation