- add Manager user_context, NewAPI billing_context, and Agnet agent_runtime deployment fields - move resource binding/grant scope toward user-owned binding_scope and secret_ref-only paths - document OpenBao internal access and unified heicode.xinghanlab.com routing boundaries - fix Manager session user id preservation after external auth login