feat: return bind credentials and reuse sync-bound agents on register (Z28)

Phone/bind-code/ticket responses include rotated client_secret; SelfRegister reuses active sync_bound hosts instead of spawning pending; archive coop opinion and keep a living summary.

Co-authored-by: Cursor <cursoragent@cursor.com>

platform/internal/logic/applogic/yuheng_ticket.go

@@ -199,6 +199,11 @@ func (l *AuthLogic) bindUserHostSync(u *userstore.User, hostKey, name, localID,
 	if err != nil {
 		return nil, "", err
 	}
+	// Z28：绑定成功后轮换密钥并回传，宇恒可直接换票，无需再 SelfRegister pending
+	secret, err = l.svcCtx.Agents.RotateSecret(l.ctx, updated.TenantID, updated.AgentID)
+	if err != nil {
+		return nil, "", fmt.Errorf("rotate client_secret: %w", err)
+	}
 	if localID == "" {
 		localID = "host:" + hostKey
 	}