fix(identity): close the check-then-act race on max_agents

[AmirF194]

Summary

EnforceAgentCreate (the max_agents pre-check) and CreateAgent (the insert) ran as two independent operations with nothing serializing them: concurrent POST /v1/agents requests could all read the same pre-insert count and all pass. Reported with a live reproduction against real Postgres: 8 concurrent requests against a cap of 1, all 8 succeeded.

CreateAgentWithLimit now takes a per-user advisory lock (keyspace 2, distinct from claimOrCreateDomain's keyspace 1) and re-checks the count inside the same transaction as the INSERT, mirroring #901's fix for max_domains. handleCreateAgent calls it directly instead of EnforceAgentCreate + CreateAgent. EnforceAgentCreate stays wired, called only on the limit-exceeded path, to attach the plan/upgrade-URL details a bare AgentLimitExceededError doesn't carry; if it's unset or doesn't corroborate, the endpoint still answers 402 from the bare error.

Operational risk

No schema change, no behavior change on the non-concurrent path or in the 402 response shape (still limit_exceeded / resource agents, same fields). A request that previously slipped past the cap under a race now gets 402 limit_exceeded, the same response the endpoint already returns for a non-racy over-cap request.

internal/agent/oauth_handlers.go's issueOAuthCodeWithNewAgent (the OAuth auto-provisioning path) also creates an agent, via CreateAgentTx, and does not check max_agents at all, before or after this change. Left alone here (different mechanism, and I don't have context on the intended cap behavior for auto-provisioning); flagged in the issue.

Client surface checklist

Not applicable: internal concurrency fix, the request/response shape of POST /v1/agents is unchanged.

Test plan

• New e2e test (internal/e2e/agents_create_race_e2e_test.go, -tags integration): 8 concurrent POST /v1/agents against max_agents=1. Fails on main (8/8 succeed, cap blown 8x), passes on this branch (1 created, 7 402 limit_exceeded), both against a real Postgres 16 container.
• go test ./internal/identity/... and ./internal/httpapi/... green, including two new unit tests for the GetLimits-failure and enforcer-unwired error-mapping paths.
• go test ./... (the Go tests job's own command) green.
• internal/httpapi coverage 87.0%, above the package's 73% floor.
• Not verified: contention beyond 8 concurrent requests, or across more than one connection pool / process.

Fixes #940