…nitializ#9)

Reviewer flagged: handleCreateAgent decoded JSON, checked only name and
model_provider, then handed opts.Auth (with an arbitrary Settings
map[string]any) straight to CreateFunc. The validate package's
ValidateAuthConfig existed but was never called on this path — so a
buggy frontend could POST an oidc payload missing issuer/audience, the
agent directory would scaffold cleanly with a malformed auth: block,
and the error would only surface when the user ran `forge run`. By
then the directory, .env.example, and channel tokens are all on disk.

Fix:
- New validateAuthPayload(opts.Auth) helper in handlers_create.go.
- Called from handleCreateAgent immediately after the name/provider
  checks, BEFORE CreateFunc runs.
- Translates AuthCreateOptions → types.AuthConfig exactly the way
  cmd/ui.go's createFunc does, so this check sees the same shape the
  eventual scaffold will. No drift between "wizard accepts" and
  "forge validate accepts".
- 400 with the validation errors joined as the response message.
- Modes "" / "none" / "custom" skip validation — they don't write
  provider entries, nothing to validate.

Validation surface (delegated to validate.ValidateAuthConfig):
  - oidc:          issuer + audience required
  - http_verifier: url required
  - static_token:  token or token_env required
  - unknown type:  rejected with list of known types

The frontend's pre-submit checks (canNext in app.js step 8) already
guard the happy path, but those are defense in depth at best — anyone
with curl can bypass them. This is the server-side enforcement that
matters.

Tests:
  TestHandleCreateAgent_OIDCMissingIssuerRejected      400, error names "issuer"
  TestHandleCreateAgent_OIDCMissingAudienceRejected    400, error names "audience"
  TestHandleCreateAgent_OIDCBothFieldsAccepted         201 (regression)
  TestHandleCreateAgent_HTTPVerifierMissingURLRejected 400, error names "url"
  TestHandleCreateAgent_UnknownAuthModeRejected        400, error names unknown type
  TestHandleCreateAgent_NoneAndCustomSkipValidation    201 for mode=none and mode=custom
  TestHandleCreateAgent_WithoutAuthPayload             201 with nil Auth (regression)

Each failure test also asserts that CreateFunc was NOT called — the
agent directory must never exist on disk for malformed auth.

Verification:
  go test -race ./forge-ui/ — green
  full sweep — all packages pass
  golangci-lint v2.10.1 — 0 issues