feat: simplify agent permissions and require current ZIP backups

apps/api/prisma/migrations/20261004090000_agent_permanent_tokens/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE `AgentGrant` MODIFY `expiresAt` DATETIME(3) NULL COMMENT '访问令牌到期时间，UTC；空表示可撤销的永久个人令牌';

apps/api/prisma/migrations/20261004103000_agent_connection_permissions/migration.sql

@@ -0,0 +1,3 @@
+-- Metadata only. Preserve existing policy rows; the application no longer reads them.
+ALTER TABLE `AgentPolicy` COMMENT = '已停用的历史 Agent 策略数据，保留原数据但不参与权限判定';
+ALTER TABLE `AgentGrant` MODIFY `scopes` JSON NOT NULL COMMENT '权限列表：read、draft 或 write；隐藏账户附加权限 hidden_read、hidden_write';