fix(oauth): enforce max_agents on auto-provisioned agents

[AmirF194]

Summary

Filed as #951: issueOAuthCodeWithNewAgent (the OAuth auto-provision path) creates an agent via CreateAgentTx with no max_agents check anywhere in the file, unlike POST /v1/agents, which has always called EnforceAgentCreate before inserting (even before #942's atomicity fix). This wires in the same check, right before the transaction that creates the agent.

Client surface checklist

Not applicable: no API or client surface change. The consent flow's response when the cap is already hit changes from a 303 redirect that silently creates the agent anyway to 402 Payment Required, the same status and error shape POST /v1/agents already returns for the identical condition.

Operational risk

No schema change. An OAuth consent request that previously created an agent past the cap now gets 402 limit_exceeded instead, matching the REST endpoint's existing behavior for the same account state.

Test plan

• New test (internal/agent/oauth_consent_test.go, TestHTTP_Consent_Allow_CreateNew_AtAgentCap) drives the real consent HTTP handler with max_agents: 0. Fails on main (303, agent created), passes on this branch (402, no agent row, no auth code issued), both against a real Postgres 16 container.
• go test ./internal/agent/... and go test ./... (the Go tests job's own command) both green.
• gofmt -l . and make fmt-check clean.
• Not verified: CheckAgentCreate failing for a reason other than the limit itself (a DB error, say) has no dedicated test here, matching the equivalent branch on the REST path, which is also untested today.

Fixes #951