feat: Per-agent GitHub PAT configuration

[vybe]

Summary

Allow configuring a GitHub Personal Access Token (PAT) per agent, with fallback to the global system PAT if not set. This enables agents to use different GitHub accounts or tokens with different scopes/permissions.

Current Behavior

• Single global GitHub PAT stored in system_settings table
• All agents share the same PAT for git operations (clone, push, pull)
• PAT retrieved via SettingsService.get_github_pat() with env var fallback

Proposed Behavior

1. Each agent can optionally have its own GitHub PAT configured
2. If per-agent PAT is set → use it for that agent's git operations
3. If not set → fall back to global system PAT (current behavior)
4. Configurable via UI, API, and MCP tools

Implementation Plan

1. Database Schema

Add github_pat column to agent_git_config table:

ALTER TABLE agent_git_config ADD COLUMN github_pat TEXT;

2. DB Operations

Add methods following the ResourcesMixin pattern:

• get_agent_github_pat(agent_name) -> Optional[str]
• set_agent_github_pat(agent_name, pat) -> bool
• clear_agent_github_pat(agent_name) -> bool

3. Service Layer

Create helper function:

def get_github_pat_for_agent(agent_name: str) -> str:
    """Get per-agent PAT if set, otherwise fall back to global."""
    agent_pat = db.get_agent_github_pat(agent_name)
    return agent_pat if agent_pat else get_github_pat()

Update callers:

• routers/git.py:initialize_github_sync()
• services/git_service.py (already accepts github_pat param)

4. Backend API Endpoints

Add to routers/agent_config.py:

GET    /api/agents/{name}/github-pat  → { configured: bool, source: "agent"|"global" }
PUT    /api/agents/{name}/github-pat  → Set agent PAT
DELETE /api/agents/{name}/github-pat  → Clear agent PAT (revert to global)

5. MCP Tools

Add to src/mcp-server/src/tools/agents.ts:

• set_agent_github_pat - Set/clear GitHub PAT for an agent
• get_agent_github_pat_status - Check if agent has custom PAT configured

6. Frontend UI

Add to GitPanel.vue or Settings section in AgentDetail.vue:

• Password input field (masked)
• Status indicator showing "Using: Agent Token" or "Using: Global Token"
• Configure/Clear buttons

Security Considerations

• Never return actual PAT value in GET responses (only configured: true/false)
• Encrypt PAT at rest in database
• Validate PAT against GitHub API before saving (check scopes)
• Audit log PAT changes (without values)

Files to Modify

Component	Files
Schema	db/schema.py, db/migrations.py
DB operations	db/agent_settings/ (new mixin or existing)
Service	services/settings_service.py or new file
Router	routers/agent_config.py or routers/git.py
MCP	src/mcp-server/src/tools/agents.ts
Frontend	components/GitPanel.vue, views/AgentDetail.vue

Acceptance Criteria

• Per-agent GitHub PAT can be set via UI
• Per-agent GitHub PAT can be set via API (PUT /api/agents/{name}/github-pat)
• Per-agent GitHub PAT can be set via MCP tool
• Git operations use agent PAT when configured, global PAT otherwise
• PAT values are never exposed in API responses
• Clearing agent PAT reverts to global PAT behavior