feat: add agent and session subsystem (preview) (#63)

## Summary
Adds an opt-in agent/session subsystem on top of the existing MCP
gateway:
- New `/agents` and `/sessions` REST endpoints for defining LLM agents
and running them.
- Foundry-backed `AgentRunner` with MCP tool loop, multi-turn
continuation, and sub-agent invocation (`agent:` prefix).
- SSE event stream (`Started`, `ToolCallRequested`, `ToolCallCompleted`,
`TokenDelta`, `Completed`) for `POST /sessions/run` and `POST
/sessions/{id}/messages`.
- Built-in tools (`bash`, `read_file`, `write_file`) with regex
denylist, per-stream output cap, max file size, and a per-session disk
quota.
- Cosmos and in-memory stores for `AgentResource` / `SessionResource`.

The feature is **disabled by default** — `IFoundryChatClient` is only
registered when `FoundrySettings:Endpoint` is configured, so existing
users see no behavior change.

## Preview / single-replica scope
README marks this as preview. Built-in tools run in-process; per-session
state (working dir, quota counters) is pod-local. Multi-replica /
multi-tenant production use needs an out-of-process sandbox and shared
storage — flagged in `BuiltinToolExecutor.cs` and the README.

## Validation
- `dotnet build` clean (Release, 0 warnings).
- `dotnet test` all green (127/127: Service 9, Tools 27, Management 91).
- New deps: `Azure.AI.OpenAI 2.1.0`, `Azure.Identity 1.13.1`,
`Microsoft.Extensions.Http 9.0.10`.

## Docs
README has a new "Agents and Sessions (Preview)" section covering
enablement, sample requests, SSE event types, and security limits.