feat(ai): add remote coding agent sessions for SSH hosts (#1545)

* feat(ai): add host coding agent sessions with configured providers

* Wait for agent initialization and shutdown before resuming sessions

* Keep Pi transcripts outside its configuration migration directory

* Cover Pi session directory separation

* Update core permission catalog expectations for remote agents

* Install remote agent runtimes from verified official sources

* Wait for the identity panel credentials request in its test

* Add scoped SSH forwarding setup for remote agents

* Verify forwarding setup through a fresh SSH connection

* Bound the SSH forwarding verification timeout

* Return the forwarding verification callback result

* fix(ai): support agent send and interrupt keyboard shortcuts

* feat(ai): add agent queues attachments worktrees and session recovery

* fix(ai): handle deleted workspace paths and duplicate status events

* fix(ai): accept file references in root workspaces

* fix(ai): refresh paused queues after agent errors

* fix(ai): store agent sessions in plugin tables and lock down OpenCode

Agent sessions lived in a single ctx.kv value holding up to 2000 events,
which passed the 256 KB kv limit within minutes of a normal run. Every
save after that failed, so history, nativeId, queue and archive changes
were lost and every event wrote a kv audit row.

Sessions, events and queued prompts now have their own tables. A running
agent appends events in batches at most once a second with a lazy save;
session and queue changes save immediately. Prompts, drafts and stored
event text are capped in UTF-8 bytes to fit MySQL TEXT. kv:own is no
longer requested.

The OpenCode server now requires a per-session password, so other local
accounts on the host cannot drive the agent through its loopback port.

* test(upgrade): include agent session tables in the reviewed upgrade SQL

plugins/ai/manifest.json

@@ -25,7 +25,8 @@
     "notify:send",
     "network:serve",
     "ui:surface",
-    "users:impersonate"
+    "users:impersonate",
+    "events:core"
   ],
   "optionalDependencies": {
     "workspaces": "^1.0.0",
@@ -87,6 +88,12 @@
         "titleKey": "nav.ai",
         "icon": "Sparkles",
         "openFrom": ["rail", "palette"]
+      },
+      {
+        "id": "ai-agents",
+        "titleKey": "agents.title",
+        "icon": "Bot",
+        "openFrom": ["host-context-menu", "palette"]
       }
     ],
     "actions": [
@@ -130,6 +137,12 @@
         "titleKey": "permissions.secrets.share.title",
         "descriptionKey": "permissions.secrets.share.description",
         "defaultRoles": ["user"]
+      },
+      {
+        "name": "agents",
+        "titleKey": "agents.permissionTitle",
+        "descriptionKey": "agents.permissionDescription",
+        "defaultRoles": ["admin"]
       }
     ],
     "settings": {