feat: return bind credentials and reuse sync-bound agents on register (Z28)

Phone/bind-code/ticket responses include rotated client_secret; SelfRegister reuses active sync_bound hosts instead of spawning pending; archive coop opinion and keep a living summary.

Co-authored-by: Cursor <cursoragent@cursor.com>

web/src/AgentUsersPage.tsx

@@ -180,9 +180,17 @@ export function AgentUsersPage(props: {
     }
   }
 
-  const statusTag = (s: string) => {
-    if (s === "active") return <Tag color="success">active</Tag>;
-    if (s === "pending") return <Tag color="warning">pending</Tag>;
+  const statusTag = (s: string, r?: AgentAccount) => {
+    if (s === "active") {
+      const syncBound = !!(r?.channel_id && r?.online_db_id);
+      return (
+        <Space size={4}>
+          <Tag color="success">active</Tag>
+          {syncBound ? <Tag color="blue">同步已绑</Tag> : null}
+        </Space>
+      );
+    }
+    if (s === "pending") return <Tag color="warning">pending · 仅登记</Tag>;
     return <Tag>{s}</Tag>;
   };
 
@@ -232,7 +240,7 @@ export function AgentUsersPage(props: {
             dataIndex: "client_id",
             render: (v) => <Typography.Text code>{v}</Typography.Text>,
           },
-          { title: "状态", dataIndex: "status", width: 110, render: statusTag },
+          { title: "状态", dataIndex: "status", width: 160, render: (s: string, r: AgentAccount) => statusTag(s, r) },
           {
             title: "角色",
             render: (_, r) => r.role_name || r.role_code || "—",