fix(agent): auto-start scenario chat, robust HITL resume, strict service auth

- frontend: fix auto-start on dashboards->/agent navigation (undefined params
  ReferenceError), route initial connect through ConnectionManager with auto-retry,
  reset runModel on objectId change and failed recovery
- agent: fix closure-over-loop-variable bug in _inject_env_id_into_tools (env now
  resolved from request-local ContextVar; idempotent wrapping), make
  execute_dashboard_result.result_key optional, resilient checkpoint resume with
  ToolMessage repair + direct-tool fallback, remove dead fast-path, consolidate
  tool_call parsing in _tool_resolver, context-safe ContextVar resets
- backend: llm-config gated by strict service-only auth (no user-JWT fallback),
  tighten idempotent run reuse (dashboard/env/intent match + 6h staleness),
  terminal event transitions run.status to COMPLETED/FAILED/CANCELLED,
  null-safe metric parsing in dashboard query model
- run.sh/docker-compose: require SERVICE_JWT (random per-run secret) instead of
  public default

shared/src/ss_tools/shared/_llm_health.py

@@ -51,8 +51,12 @@ async def _check_llm_provider_health() -> str:
     # Fetch LLM config from backend's own API (same as agent container does)
     try:
         fastapi_url = os.getenv("FASTAPI_URL", "http://localhost:8000")
+        headers = {}
+        service_token = os.getenv("SERVICE_JWT", "").strip()
+        if service_token:
+            headers["Authorization"] = f"Bearer {service_token}"
         client = get_shared_http_client(timeout=10)
-        resp = await client.get(f"{fastapi_url}/api/agent/llm-config")
+        resp = await client.get(f"{fastapi_url}/api/agent/llm-config", headers=headers)
         if resp.status_code != 200:
             _llm_status["status"] = "unavailable"
             _llm_status["last_error"] = f"LLM config endpoint returned {resp.status_code}"