feat(studio): agent workbench, manage-agent, and VeFaaS studio deploy

[yaozheng-fang]

Unified PR that aggregates and supersedes #655 and #657, plus the new work built on top of them. (Please close #655 and #657 in favor of this.)

Frontend

• Agent-type workbench + recursive conversation topology (live highlight + delegation path), per-session streaming (parallel sessions), typed agent graph. (was feat(frontend): agent-type workbench, conversation topology, per-session streaming #657)
• Deploy panel: live 构建镜像 → 部署 → 发布 stepper driven by an SSE stream; failure pinned to the failing stage.
• New 「管理 Agent」 view: lists the current user's runtimes (filtered by an author tag), control-plane detail (model/resources/envs with secrets masked/status), and the runtime's sub-agent tree via a single introspection endpoint on the main agent; delete with confirm.
• Studio mode: per-module feature gates sourced from /web/ui-config (hide new-chat/search/skill-center/history; land on the add-agent page; hide the remote "添加 AgentKit 智能体" card).
• --open browser flag on veadk frontend. (was feat(cli): optionally open the browser when veadk frontend is ready #655)

Backend (veadk frontend / veadk studio)

• /web/deploy-agentkit refactored to call the AgentKit SDK in-process and stream per-stage progress (SSE), tagging created runtimes with the deploying user.
• New endpoints: /web/my-runtimes, /web/delete-runtime, /web/runtime-detail, /web/ui-config.
• /web/* resolve Volcengine credentials env → VeFaaS role STS credential file (with session token), so a hosted UI manages runtimes via its IAM role — never env AK/SK.
• Generated project app.py exposes /web/agent-graph for sub-agent introspection.

veadk studio deploy (VeFaaS)

• New studio command group; veadk studio deploy deploys the SSO web frontend to VeFaaS:
  • auto-creates the IAM role + custom policy (trust vefaas),
  • reuses a serverless APIG gateway (creates one if none),
  • builds/ships the app (--from-source bundles a local wheel),
  • registers the SSO callback on the user-pool client with the deployer's creds,
  • two-phase re-release injecting OAUTH2_REDIRECT_URI,
  • ships only non-secret env to the function.
• IdentityClient user-pool methods now use @refresh_credentials so they work with the FaaS role's STS credentials.

Notes

• Verified end-to-end on real VeFaaS/AgentKit: deploy stream, runtime tag/list/delete, studio SSO login, clean function env (no AK/SK).