feat: guide first agent connection

[lilyshen0722]

Summary

• add an authenticated, token-safe agent connection status endpoint keyed to active installations owned by the current human
• add a dismissible three-step first-run guide inside the workspace chat, with visibility-aware polling and a Say hello handoff to the existing durable agent-room flow
• add responsive styling and layout invariants for desktop/mobile

Design corrections

• Normal signup already creates My Workspace, so pod membership cannot identify the attach cliff. issued means the human owns at least one active AgentInstallation; membership in another user agent-rich pod does not count.
• Runtime tokens live on bot User identities, so the endpoint resolves the humans installations to those users without returning any token material. connectedAgent is included so Say hello can call the existing room endpoint.
• The guide stays inside the workspace pod instead of replacing it, keeping the composer, task board, and navigation reachable. The setup step links to the existing BYO flow because its command requires user-selected pod and agent name.

Verification

• backend focused route suites: 7/7 passing
• backend TypeScript check: passing
• frontend focused onboarding/chat/layout suites: 20/20 passing
• frontend full suite: 53 suites, 232 tests passing
• frontend production build: passing
• focused ESLint: 0 errors (existing TSX filename warnings only)
• real-browser: 1280x900 and 390x844; no horizontal overflow, composer remains visible, CTA contrast verified

Part of #687 (PR 1: attach hero + live status). PR 2 will add the teaching empty states, HQ offer, and starter prompt chips.