Run Claude and Codex Agent Sessions with Agent Login on the home volume

[ExtraToast]

Design: #59 (the glossary and ADRs). Use the glossary's terms.

What to build

The user starts a Claude or Codex Agent Session. If that provider has no Agent Login yet, the user signs in from the terminal in the session, and agents-ui shows a hint explaining this. The CLI writes its own login files to the home volume, and every Workspace then shares that Agent Login across pod restarts. The login worker path goes away entirely: the internal credentials endpoint, the OAuth credentials table and the per-Workspace credential Secret code are removed, and so are agents-ui's login screens.

Implements ADR 0002: Agent Login lives only on the home volume.

Acceptance criteria

• Claude and Codex Agent Sessions start as agent in a Workspace.
• Signing in once from a terminal is enough for Agent Sessions in every Workspace, and it survives a container restart with the home volume kept.
• A missing Agent Login shows the sign-in hint in agents-ui instead of an error.
• The internal credentials endpoint, the OAuth credentials table (dropped by migration) and the credential Secret management are removed.
• agents-ui has no login or credential capture screens.

Blocked by

• Tracer bullet: run a Shell Agent Session in a Scratch Workspace inside the API container #62