feat(server): implement full REST API with JWT auth and real-time WebSocket

- Add HTTP handlers for issues, comments, agents, workspaces, inbox, members, and activity
- Implement JWT authentication middleware with Bearer token validation
- Add sqlc queries for all entities (CRUD operations)
- Extract router into reusable NewRouter() for testability
- Expand SDK with full API client methods (CRUD for all resources)
- Add updateWorkspace to SDK, add Member type to shared types

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/pkg/db/queries/agent.sql

@@ -0,0 +1,30 @@
+-- name: ListAgents :many
+SELECT * FROM agent
+WHERE workspace_id = $1
+ORDER BY created_at ASC;
+
+-- name: GetAgent :one
+SELECT * FROM agent
+WHERE id = $1;
+
+-- name: CreateAgent :one
+INSERT INTO agent (
+    workspace_id, name, avatar_url, runtime_mode,
+    runtime_config, visibility, max_concurrent_tasks, owner_id
+) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+RETURNING *;
+
+-- name: UpdateAgent :one
+UPDATE agent SET
+    name = COALESCE(sqlc.narg('name'), name),
+    avatar_url = COALESCE(sqlc.narg('avatar_url'), avatar_url),
+    runtime_config = COALESCE(sqlc.narg('runtime_config'), runtime_config),
+    visibility = COALESCE(sqlc.narg('visibility'), visibility),
+    status = COALESCE(sqlc.narg('status'), status),
+    max_concurrent_tasks = COALESCE(sqlc.narg('max_concurrent_tasks'), max_concurrent_tasks),
+    updated_at = now()
+WHERE id = $1
+RETURNING *;
+
+-- name: DeleteAgent :exec
+DELETE FROM agent WHERE id = $1;