Add isolated Fly agents and self-service MCP settings

[Annedaynl]

What changed

• add a Fly.io managed-agent backend that provisions one isolated app, Machine, volume, and secret set per agent
• add the pinned Fly agent image and deployment examples
• let a linked agent override its own LLM provider and model without changing the reusable persona
• add a per-agent MCP connections screen for remote HTTPS servers, transport selection, bearer/no-auth credentials, and exact tool allowlists
• carry agent-scoped MCP profiles through Fly and enforce tool allowlists in Buzz Agent on startup and reconnect

Why

Cloud agents previously depended on inherited persona/global model settings and required raw MCP profile configuration. That prevented owners from independently choosing Claude or GPT for each agent and made connecting separate MCP accounts too operationally heavy.

This change keeps each agent's model credential and MCP credentials inside that agent's configuration and Fly secret boundary. Bearer values are referenced through environment variables rather than embedded in the MCP JSON profile.

Owner experience

In Edit Agent, an owner can now choose an agent-specific provider/model and add remote MCP connections with an optional exact tool allowlist. The first screen deliberately supports bearer-token and no-auth servers only. OAuth remains future work because it needs a stable callback bridge and encrypted token lifecycle.

Validation

• Desktop JavaScript: 4,029 tests passed
• Desktop TypeScript and repository checks passed
• Desktop Rust: 2,149 tests passed; 14 environment-dependent cases ignored
• full buzz-acp, buzz-agent, and buzz-backend-fly package suites passed
• warning-denying Clippy passed for Desktop and the changed runtime packages

Originating Buzz channel: AI Management (5038ba1c-66e8-4fb4-a96f-0a5801126938).

[wolfyy970]

I opened #4588 for the Project-owned side of this. It lets a connection be configured and tested once at the Project level, while agents bind to it without carrying or duplicating credentials. I think that boundary complements the per-agent Fly settings here.