Add agents to a bootstrapped connection

Provision an additional agent on a connection that has already been bootstrapped, from a template belonging to the same app. plt_ auth only.

One agent per call. A template declaring more than one agent is refused with 400: each agent's API key is returned once and cannot be re-issued to a platform app, so batching them would put several unrecoverable credentials in a single response.

Bootstrap refuses a second run (409) because it also creates the vault, the policies and the plan tier, none of which should happen twice. This route applies only the agent portion of a template: its agents, their per-agent signing_keys, eoa and runtime. vault, policies, automations and entitlements in the spec are ignored, and new agents attach to the vault the connection already has.

Configuration comes from a template rather than from fields on the request so that the agent portion of a spec has exactly one reader, shared with bootstrap.

Capped per connection by max_agents_per_connection on the platform app (unset means a built-in default, not unlimited: an agent with signing keys costs a KMS key per chain). The whole batch is checked before anything is created, so a template that would overshoot is refused rather than partly applied.