feat(consents): auto-grant data:<provider> on connect; remove agent: consents (ADR-0015)

- integrations.ts: grant data:<provider> on OAuth callback, revoke on disconnect
- Backfill migration: INSERT OR IGNORE data:<provider> for all active tokens
- Agent manifests: drop agent:<id> from required_consents (momentum, time-of-day,
  overdue-task, recent-patterns, health-vitals) — per-agent control is a preference
- eligibility.ts: update comment to reflect data:-only consent model
- test_manifest.py: assert no agent: consents remain in any manifest
- migrations.test.ts: backfill idempotency tests for issue #127
- Dockerfile.api: drop --offline flag (fixes ERR_PNPM_NO_OFFLINE_META)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ml/agents/health_vitals.py

@@ -40,7 +40,7 @@ MANIFEST = AgentManifest(
         },
     },
     context_schema=["google-health.steps", "google-health.sleep", "google-health.activity", "google-health.heart_rate"],
-    required_consents=["data:core", "data:google-health", "agent:health-vitals"],
+    required_consents=["data:core", "data:google-health"],
     output_contract={"type": "snippet", "format": "free_text"},
     ttl_sec=1800,  # refresh every 30 min — health data changes during the day
     silenced_in_contexts=[],