feat: add provisioning agent bootstrap and check-in endpoints

Adds POST /api/v1/agent/bootstrap (issues a hashed agent secret for a
device) and POST /api/v1/agent/checkin (Bearer-authenticated, resolves
the device's assigned blueprints via its Bereitstellungsvorlage and
returns them alongside the ansible-content repo URL and poll
interval). Migration 0006 adds the backing columns on devices
(agent_secret_hash, agent_secret_issued_at, agent_last_checkin).

This was implemented and verified end to end (activate -> resolve ->
bootstrap -> checkin, plus a full QEMU agent test) in an earlier
session but never committed to this repo, even though it has been
running in production on anode since. Committing now to close that
gap before building on top of it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

migrations/0006_agent_credentials.sql

@@ -0,0 +1,7 @@
+BEGIN;
+
+ALTER TABLE devices ADD COLUMN agent_secret_hash TEXT;
+ALTER TABLE devices ADD COLUMN agent_secret_issued_at TIMESTAMPTZ;
+ALTER TABLE devices ADD COLUMN agent_last_checkin TIMESTAMPTZ;
+
+COMMIT;