Add project-root context binding for agent identification

[sebastientaggart]

Summary

Adds project context (project_root, active_file) to agents so multiple instances of the same agent type can be distinguished by workspace. The OpenDeck plugin now displays context-aware labels like "claude-code: my-project" instead of generic IDs like "mock-1".

Changes

• AgentBase: New project_root and active_file fields, plus a display_label property that derives a human-friendly label from the project root.
• API: New POST /agents/register (register external agents with context) and PATCH /agents/{id}/context (update context, emits agent.context_changed event).
• Bridge: register_agent() and update_agent_context() HTTP client methods.
• OpenDeck plugin: agent_status and agent_dashboard handlers use display_label and listen for agent.context_changed events.
• Tests: 5 new tests covering registration, duplicate detection, context updates, 404 handling, and label fallback.

Drive-by fixes (in scope per user request)

• Makefile: uv run uvicorn → uv run python -m uvicorn (binary entry-point wasn't resolvable).
• Config auto-discovery: Settings now auto-loads ./config.toml if DECKHAND_CONFIG_FILE isn't set.
• Dropped legacy api_key field: only api_keys = [...] is supported now (unreleased software, no migration needed).
• .gitignore: added config.toml to prevent committing local secrets.

Closes #2

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [NOTE] register_agent defines ExternalAgent as a nested class inside the route handler. It works, but hoisting it to module scope (or deckhand/agents/external.py) would avoid redefining the class on every request and make it reusable. Non-blocking.
• [NOTE] display_label uses rstrip("/") + rsplit("/", 1), which is POSIX-only. On Windows paths with backslashes the label would fall back to the full string. Not a concern for the current deployment target.
• [NOTE] Dropping the legacy api_key field is a breaking change; PR description acknowledges this is pre-release so acceptable.

No correctness, security, or platform-compliance issues found. Tests cover the new endpoints (register/duplicate/update/404/fallback label) and the existing list test was extended to assert context fields.