feat: add first-class agent management

.changeset/agent-management-api.md

@@ -0,0 +1,6 @@
+---
+"server": minor
+"dashboard": minor
+---
+
+Add human-only APIs and setup controls for creating and managing first-class agent principals.

.speakeasy/openapi-hooks.yaml

@@ -755,6 +755,8 @@ tags:
     description: Manage roles, team member access control, and authorization challenge events.
   - name: agent
     description: Endpoints consumed by the Speakeasy device agent running on developer machines. Authenticates via an API key carrying the 'agent_user' scope — the per-user credential minted by token-exchange. An org key with the broader 'agent' scope also satisfies most of these endpoints (it implies 'agent_user'), so existing installs keep working during the transition. The content-bearing session-portability endpoints — getSessionMeta and createSessionHandoff — refuse it and require a per-user key.
+  - name: agents
+    description: Human-only management of first-class agent principals.
   - name: aiIntegrations
     description: Manage organization-level AI provider integrations.
   - name: assets