feat(center): API-key agent auth

UserApiKey (apiKeyHash->userId); CLI 'user apikey --email'; POST
/auth/agent/login {apiKey} -> normal user session (api-key-guard exempt).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/entities/user-api-key.entity.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from 'typeorm';
+
+// Machine credential for an agent: a long-lived API key that maps to a user.
+// The plugin exchanges it for a normal user session (POST /auth/agent/login).
+@Entity('user_api_keys')
+export class UserApiKey {
+  @PrimaryGeneratedColumn('uuid')
+  id!: string;
+
+  @Index()
+  @Column({ name: 'user_id', type: 'varchar', length: 64 })
+  userId!: string;
+
+  @Column({ name: 'api_key_hash', type: 'varchar', length: 255 })
+  apiKeyHash!: string;
+
+  @Column({ type: 'varchar', length: 120, nullable: true })
+  label!: string | null;
+
+  @CreateDateColumn()
+  createdAt!: Date;
+}