fix(agent): resolve ModuleNotFoundError for backend, add E2E test infra

- Dockerfile.agent: fix CMD (python -m src.agent.run), use backend/requirements.txt,
  minimal COPY (only src.agent + src.core.cot_logger), add GRACE contract
- docker-compose.yml: SERVICE_TOKEN_SECRET -> SERVICE_JWT (match code)
- docker-compose.enterprise-clean.yml: same env var fix
- docker/.env.agent.example: same env var fix
- build.sh: same env var fix
- chore: semantics-testing SKILL.md, backend tests, pyproject.toml

backend/src/api/routes/settings.py

@@ -490,7 +490,13 @@ async def get_consolidated_settings(
 
         response_payload = ConsolidatedSettingsResponse(
             environments=[env.model_dump() for env in config.environments],
-            connections=[{**c.model_dump(), "password": "********"} for c in config.settings.connections],
+            connections=[
+                {
+                    **(c.model_dump() if not isinstance(c, dict) else c),
+                    "password": "********",
+                }
+                for c in config.settings.connections
+            ],
             llm=normalized_llm,
             llm_providers=llm_providers_list,
             logging=config.settings.logging.model_dump(),
@@ -534,13 +540,18 @@ async def update_consolidated_settings(
 
         # Update connections if provided
         if "connections" in settings_patch:
+            from ...core.config_models import DatabaseConnection as DBConnModel
+
             cs = ConnectionService(config_manager)
             # Build lookup of existing connections by id to preserve encrypted passwords
-            existing_by_id = {
-                c.id: c.password
-                for c in current_settings.connections
-            }
-            processed = []
+            # Guard: some items may still be dicts from a previous corruption — convert on the fly
+            existing_by_id: dict[str, str] = {}
+            for c in current_settings.connections:
+                if isinstance(c, dict):
+                    existing_by_id[c.get("id", "")] = c.get("password", "")
+                else:
+                    existing_by_id[c.id] = c.password
+            processed: list[DBConnModel] = []
             for conn_dict in settings_patch["connections"]:
                 conn_id = conn_dict.get("id", "")
                 raw_pwd = conn_dict.get("password", "")
@@ -549,7 +560,8 @@ async def update_consolidated_settings(
                     conn_dict["password"] = existing_by_id[conn_id]
                 elif raw_pwd and raw_pwd != "********":
                     conn_dict["password"] = cs._encrypt_password(raw_pwd)
-                processed.append(conn_dict)
+                # Convert dict to DatabaseConnection model to preserve typed interface
+                processed.append(DBConnModel(**conn_dict))
             current_settings.connections = processed
 
         # Update LLM if provided