fix: harden tenant-safe runtime delivery

[fengnanrui]

Summary

• restore FastAPI database-session injection across affected API routes
• require explicit tenant ownership for every ChatMessage writer and enforce it at the ORM/database boundary
• make the f061 enterprise migration retry-safe and add a single-head f062 NOT NULL migration
• expose and validate model context-window limits, including clearing optional limits
• bind unconfigured agents when the first/default model is selected
• back off heartbeat intake failures and show recoverable chat/agent UI errors
• add configurable Agent Docker enablement and container naming

Root cause

Database route parameters defaulted to None instead of Depends(get_db), tenant-scoped chat rows could be persisted with a NULL tenant_id and then disappear behind tenant filtering, and the enterprise migration attempted to recreate schema objects already present on fresh installs. The live-stream warning consequently described execution as continuing even when delivery reconciliation had failed.

Validation

• frontend: npm run build (TypeScript + Vite)
• backend: compileall and AST contracts for API DB injection and ChatMessage tenant ownership
• migration graph: one head (f062_chat_message_tenant_nn)
• Ruff: new migration and regression-test files pass; the repository-wide pre-existing lint baseline remains non-zero
• gitleaks: changed diff scanned with no leaks
• deployed regression run: 62 targeted backend tests passed and a real Qwen chat response was delivered

Compatibility / operations

The f062 migration intentionally fails if legacy chat_messages rows still have NULL tenant_id. Operators must reconcile ownership out of band; the migration does not guess tenant ownership. LICENSE and upstream history are unchanged. No environment files, credentials, private keys, deployment passwords, or server-specific compose files are included.

Fixes #962