Merge SERVICE role into AGENT

Every AGENT now gets an auto-generated API key on creation, shown once
in a modal. AGENTs log in with password and authenticate to the API
with X-Api-Key. pre-push.sql defensively migrates any residual SERVICE
rows to AGENT before Prisma rewrites the enum. Goddard is no longer
baked into the seed — create agents via Admin → Users.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

shared/schemas/user.ts

@@ -5,7 +5,7 @@ export const createUserSchema = z.object({
   username: z.string().min(1).max(50),
   email: z.string().email(),
   displayName: z.string().min(1).max(100),
-  password: z.string().min(8).optional(),
+  password: z.string().min(8),
   role: roleSchema.default('AGENT'),
 });