feat: Auto-propagate GitHub PAT to all agents on update

[vybe]

Problem

When an admin updates the GitHub PAT in Settings, running agents continue using the old PAT. The admin must manually restart each agent or call a propagation endpoint.

Solution

Make PAT propagation the default behavior when the PAT is updated. In the existing update_github_pat endpoint (settings.py:268), after saving the new PAT to the database, automatically propagate it to all active agents.

Implementation

@router.put("/settings/github-pat")
async def update_github_pat(...):
    # ... existing validation and save logic ...
    
    # Auto-propagate to all active agents
    propagation_result = await propagate_github_pat_to_agents(new_pat)
    
    return {
        "status": "updated",
        "propagation": propagation_result
    }

Frontend

Update the Settings page to show propagation results after PAT update:

• "PAT updated and applied to 5 agents"
• Or warning: "PAT updated but failed to apply to: agent-x, agent-y"

Dependencies

• Depends on the propagation endpoint/service being implemented first (#TBD)

Files

• src/backend/routers/settings.py (update_github_pat endpoint, line 268)
• src/frontend/src/views/Settings.vue (show propagation result)

Acceptance Criteria

• Updating GitHub PAT automatically propagates to all active agents with GITHUB_PAT
• Response includes per-agent propagation status
• Frontend shows propagation results (success count, any failures)
• Partial failures don't block the PAT update itself
• Delete PAT does NOT propagate (agents keep working until next restart)