feat(setup): persist PowerContext Agent authorization

[frf12]

Which issue or RFC does this PR close?

Closes #1538.

Depends on #1535 for the shared setup-time Server URL and insecure-HTTP consent contract.

Rationale for this change

Users connecting an Agent Host to an authenticated PowerContext Server should not need to export an Authorization variable before every new session. Sourcing the Server .env is also the wrong boundary because it can expose Generation Provider and database credentials that an Agent client does not need.

This draft opens the design-review gate requested by the repository workflow. Implementation is intentionally pending approval of the committed design.

What changes are included in this PR?

Current draft:

• adds the complete persistence design for Codex, Claude Code, DSH, OpenCode, Pi, and WorkBuddy;
• keeps OpenClaw and Hermes on their existing native secret stores;
• records DSH's UX-first config.authorization decision;
• defines URL-affine credentials, safe clear/rotation semantics, redacted diagnostics, rollback boundaries, and JSON result states;
• defines WorkBuddy's pinned URL/header pair because its MCP template cannot safely bind independent environment fallbacks;
• records the dependency and rebase/stacking boundary with feat(client): add explicit insecure HTTP opt-in across integrations #1535.

After design approval, this same draft PR will receive the TDD implementation, integration documentation, and host validation. It will not be marked ready until those changes and gates are complete.

Are there any user-facing changes?

The intended behavior is user-facing but is not implemented in this draft yet. After implementation, powercontext setup <host> will collect or reuse a Server credential once, and users will start supported Agents normally without per-launch authorization exports. --clear-authorization and redacted authorization diagnostics will be added.

No OpenAI, Anthropic, Generation Provider, embedding, or database credential will be reused or copied.

How was this change tested?

Current design-only validation:

• commit hooks: case-conflict, merge-conflict, EOF, trailing-whitespace, and ty check passed;
• git diff --check passed;
• read-only source audit covered all eight agent_host integrations;
• T1 read-only checks confirmed Pi's user configuration root and OpenCode's reported config path.

Repository baseline before implementation: the local macOS run has four environment/version-specific failures (three Linux-only systemd receiver tests and one OpenCode host ordering test). These are not accepted as final PR gates; the completed implementation must pass clean upstream CI and all affected focused suites.

AI usage statement

OpenAI Codex was used to inspect the repository, compare host configuration contracts, draft the design, and run validation. The human selected the UX-first persistence policy and explicitly chose DSH config.authorization.