feat: bind shared credentials to agent capabilities

[kapelame]

Summary

Let users select and persist an existing Workspace shared credential while enabling a Capability on an Agent. This completes the hosted OAuth connector flow introduced by #229 without adding a credential-binding table.

Scope

• Store capability-level credential_bindings in the existing agent_capabilities.configuration JSON.
• Default OAuth directory connectors to the shared Secret matching their catalog_id.
• Share one frontend credential binding picker between Agent configuration and the existing credential check panel.
• Centralize Go credential binding types, strict API parsing, lenient runtime parsing, and shared Secret validation.
• Validate bindings during Capability enable, Agent create/edit, Capability version upgrade, and Public visibility changes.
• Resolve capability bindings through the existing Agent runtime credential injection path.
• Reject upgrades when the target Capability Version introduces unsatisfied credential requirements.
• Reject Public visibility when any enabled Capability still relies on a personal credential.

Reuse and boundaries

• Reuses the existing secrets table and Secret encryption.
• Reuses agent_capabilities.configuration; no binding table or new binding column is added.
• Reuses existing Capability enable/upgrade, Agent update, and runtime injection flows.
• The mcp_oauth credential kind and migration belong to feat: add OAuth for hosted MCP connectors #229.
• Directory Catalog/query cleanup belongs to feat: add curated MCP Connector Directory core #223.
• Does not change Workspace Member permissions.

Verification

• make openapi
• make check
• Credential binding parser and shared Secret validation tests
• Agent create/edit and Capability enable regression tests
• Capability upgrade credential regression test
• Public visibility capability-binding regression test
• Runtime Secret resolution tests
• Frontend typecheck and shared picker integration
• git diff --check

Dependency

• Stacked on feat: add OAuth for hosted MCP connectors #229, which is stacked on feat: add curated MCP Connector Directory core #223.