feat: add account personal access tokens and retire agent connections

[nihey]

Summary

Users can create account-wide personal access tokens directly in Account settings and delegate product management across their current organization memberships and roles. Tokens support one-time secret display, hash-only storage, expiration and revocation; password changes, token administration and platform administration remain session-only. GraphQL billing actions return hosted Stripe checkout/portal links, and account credentials expose 42 MCP tools.

Retire the redundant Agent connections page and organization Connect agent buttons. The old URL redirects to Account's token section, where all existing scoped and legacy credentials remain available for revocation. Explicitly refresh token history when a creation response is lost. Normalize Claude setup names so organization/account names with spaces no longer fail CLI validation.

Validation

• Added API policy/authentication/lifecycle and end-to-end tests, MCP catalog/GraphQL validation, and frontend creation/recovery/history/redirect tests.
• Node.js 22: API lint/typecheck and 923 unit tests; 397 API end-to-end tests against isolated PostgreSQL/Redis; frontend lint/typecheck and 548 tests; MCP typecheck, 154 tests, build and package smoke test; worker typecheck and 252 tests.
• Reproduced Claude's rejection of a display name containing spaces, then verified the generated normalized name with the actual CLI in an isolated configuration directory.
• Independent code review completed; the lost-response history recovery finding is fixed and no actionable findings remain.
• Updated relevant documentation and confirmed no credentials, production data or populated environment files are included.

A CI-only failure exposed existing watchdog cleanup deleting other suites' accounts. Limit cleanup to watchdog fixtures; an unrelated-account regression fixture now proves isolation. Worker runtime behavior is unchanged.

Release note

@systemvitals/mcp is still unpublished: npm returns E404. Generated npm-based MCP setup requires a package release; source-checkout MCP and direct GraphQL/cURL work without publication. This PR does not publish npm artifacts. Deploy the API before the frontend. No database migration or worker change is needed.

Checklist

• Conventional commit subject used.
• Scope is focused on account token delegation and its replacement of the old agent UI.