Add agents, authentication, and file submodules

[bradleyshep]

Description of Changes

Adds an agent backend with authentication and file-storage packages used by its example application.

• Agents: provider adapters, tool calls, conversation summaries, embeddings, and stale-lock cleanup.
• Auth: password and OAuth handlers, ES256 sessions, connection binding, and profiles.
• Files: upload, listing, deletion, per-file visibility, and HTTP serving helpers.
• Package documentation, tests, examples, and generated client bindings for all three packages.

Builds on bradley/submodules-core for crypto, rate-limit, and shared example support. Auth and files are included because the agents example imports them. This branch does not depend on the Resend, Stripe, or PostHog branches.

Example screenshots

Existing example screenshots from #5823:

Agents

Auth

Files

API and ABI breaking changes

No existing SpacetimeDB API or ABI is changed. This adds new TypeScript package APIs that need review before merge.

Rollback safety impact

n/a. This adds opt-in TypeScript packages and examples; it does not change existing server storage formats.

Expected complexity level and risk

3/5

These opt-in packages do not change existing server behavior. Review complexity comes from three connected APIs: agent execution, authentication, and file access. The main risks concern session validation, file authorization, and interrupted agent work in applications that use them.

Testing

Verified locally on bradley/submodules-agents:

• Frozen-lockfile install for the root, SDK, and present submodule workspaces.
• Type checks for the added packages.
• Existing test scripts for the added packages and examples.
• Build scripts for the added packages and examples.
• Regenerate client bindings and verify no tracked changes.
• Lint and formatting checks for the added packages and examples.
• Verify workspace dependencies are present in this branch.
• Review the public APIs and resolve authentication, file-access, and agent-execution review findings.
• Exercise login, file access, and agent recovery against a running SpacetimeDB instance.
• Run credentialed OAuth and model-provider smoke tests.

Commands used for this group:

pnpm -r -F "./spacetime-agents-ts/**" -F "./spacetime-auth-ts/**" -F "./spacetime-files-ts/**" run typecheck
pnpm -r -F "./spacetime-agents-ts/**" -F "./spacetime-auth-ts/**" -F "./spacetime-files-ts/**" run test
pnpm -r -F "./spacetime-agents-ts/**" -F "./spacetime-auth-ts/**" -F "./spacetime-files-ts/**" run build
pnpm -r -F "./spacetime-agents-ts/**" -F "./spacetime-auth-ts/**" -F "./spacetime-files-ts/**" run lint

The TypeScript SDK was built first. Live deployment and provider tests were not run during split validation. Existing workspace peer-dependency warnings remain.