feat(model): add template-agent fields (reuse AgentDeployment + ResourceBinding.EnvMap)

Additive, AutoMigrate-friendly (new columns only, cross-DB safe). Foundation for
the template-agent + direct-connect model:
- AgentDeployment: TemplateID, Subdomain, AccessToken, BindingIDsJSON — reuse the
  existing deployment record as the deployed-agent record instead of a new table.
- ResourceBinding.EnvMap: declares which env vars a binding exposes to a template
  agent at start (non-secret from Metadata; secret resolved from KV only at start).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

heicode/model/agent_deployment.go

@@ -27,6 +27,14 @@ type AgentDeployment struct {
 	AgentInstancesJSON     string `gorm:"type:text" json:"agent_instances_json"`
 	PermissionManifestJSON string `gorm:"type:text" json:"permission_manifest_json"`
 	PayloadJSON            string `gorm:"type:text" json:"payload_json"`
+
+	// --- Template-agent model (new) ---
+	// A deployed template agent: started by AM with the selected bound resources
+	// injected into its .env; reachable by the desktop client directly over SSE.
+	TemplateID     string `gorm:"type:varchar(128);index" json:"template_id"`
+	Subdomain      string `gorm:"type:varchar(255)" json:"subdomain"`       // AM-assigned public address
+	AccessToken    string `gorm:"type:varchar(512)" json:"access_token"`    // client presents this to the agent; HM stores a copy
+	BindingIDsJSON string `gorm:"type:text" json:"binding_ids_json"`        // JSON array of resource_binding ids attached to this agent
 }
 
 func (AgentDeployment) TableName() string {

heicode/model/resource.go

@@ -15,6 +15,13 @@ type ResourceBinding struct {
 	ExternalId      string `json:"external_id" gorm:"type:varchar(512)"`
 	SecretRef       string `json:"secret_ref" gorm:"type:varchar(512)"`
 	Metadata        string `json:"metadata" gorm:"type:text"`
+	// EnvMap declares the environment variables this binding exposes to a
+	// template agent at start time, as a JSON object: {"ENV_NAME": {"source":
+	// "metadata|secret", "key": "<metadata field or secret json key>"}}.
+	// Non-secret values come from Metadata; secret values are resolved from the
+	// Key Vault secret (SecretRef) only at agent-start and injected into the
+	// agent's .env — never stored here in plaintext.
+	EnvMap          string `json:"env_map" gorm:"type:text"`
 	PermissionScope string `json:"permission_scope" gorm:"type:text"`
 	Constraints     string `json:"constraints" gorm:"type:text"`
 	Status          string `json:"status" gorm:"type:varchar(32);default:'active';index"`