Merge SERVICE role into AGENT

Every AGENT now gets an auto-generated API key on creation, shown once
in a modal. AGENTs log in with password and authenticate to the API
with X-Api-Key. pre-push.sql defensively migrates any residual SERVICE
rows to AGENT before Prisma rewrites the enum. Goddard is no longer
baked into the seed — create agents via Admin → Users.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server/src/middleware/auth.ts

@@ -15,7 +15,7 @@ export const authenticate = async (req: AuthRequest, res: Response, next: NextFu
 
   if (apiKey) {
     const user = await prisma.user.findUnique({ where: { apiKey } });
-    if (!user || user.role !== 'SERVICE') {
+    if (!user) {
       return res.status(401).json({ error: 'Invalid API key' });
     }
     req.user = { id: user.id, role: user.role, username: user.username };
@@ -48,7 +48,7 @@ export const requireAdmin = (req: AuthRequest, res: Response, next: NextFunction
   next();
 };
 
-// Blocks USER role — allows ADMIN, AGENT, SERVICE
+// Blocks USER role — allows ADMIN and AGENT
 export const requireAgent = (req: AuthRequest, res: Response, next: NextFunction) => {
   if (req.user?.role === 'USER') {
     return res.status(403).json({ error: 'Insufficient permissions' });