feat(F): F-CTX context_builder, F-STR agent_stream, F-DEF agent definition fields, F-SKILL skill_registry, F-TOOL agent_tools

- F-CTX: app/ai/context_builder.py (282 lines) — build_agent_context() + ReActSystemPromptBuilder
- F-STR: app/ai/agent_stream.py (155 lines) — stream_react_loop() with SSE events (step, status, done, error)
- F-DEF: AgentDefinition fields added (temperature, max_tokens, max_steps, trace_mode, skill_ids, trigger_config, ai_use_case_metadata) + migration 0122
- F-SKILL: app/ai/skill_registry.py (82 lines) — SkillDefinition + SkillRegistry singleton
- F-TOOL: app/ai/agent_tools.py (117 lines) — get_agent_tools() with permission intersection
- Skill CRUD routes: app/plugins/builtins/automation/skill_routes.py
- Tests: test_skill_registry.py (97 lines), test_agent_tools.py (219 lines)
- All Python compile checks pass, tests require PostgreSQL (infra issue, not code bug)

app/plugins/builtins/automation/models.py

@@ -62,6 +62,19 @@ class AgentDefinition(Base, TenantMixin, OwnedMixin):
     budget_limit_usd: Mapped[float] = mapped_column(
         Float, nullable=False, default=1.0
     )
+    temperature: Mapped[float] = mapped_column(Float, nullable=False, default=0.3)
+    max_tokens: Mapped[int] = mapped_column(Integer, nullable=False, default=1000)
+    max_steps: Mapped[int] = mapped_column(Integer, nullable=False, default=20)
+    trace_mode: Mapped[str] = mapped_column(
+        String(20), nullable=False, default="standard"
+    )
+    skill_ids: Mapped[list[Any]] = mapped_column(JSONB, nullable=False, default=list)
+    trigger_config: Mapped[dict[str, Any]] = mapped_column(
+        JSONB, nullable=False, default=dict
+    )
+    ai_use_case_metadata: Mapped[dict[str, Any]] = mapped_column(
+        JSONB, nullable=False, default=dict
+    )
     created_by: Mapped[uuid.UUID | None] = mapped_column(
         PGUUID(as_uuid=True), ForeignKey("users.id", ondelete="SET NULL"), nullable=True
     )
@@ -318,3 +331,34 @@ class AgentSubtask(Base, TenantMixin):
     completed_at: Mapped[datetime | None] = mapped_column(
         DateTime(timezone=True), nullable=True
     )
+
+
+class SkillDefinitionDB(Base, TenantMixin):
+    """A skill definition persisted per tenant.
+
+    Skills are orchestration metadata, NOT a permission source. They reference
+    tool IDs that the agent and the user must already be permitted to use.
+    """
+
+    __tablename__ = "automation_skill_definitions"
+    __table_args__ = (
+        Index("ix_skill_defs_tenant_active", "tenant_id", "is_active"),
+        Index("ix_skill_defs_tenant_category", "tenant_id", "category"),
+    )
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        PGUUID(as_uuid=True), primary_key=True, default=uuid.uuid4
+    )
+    name: Mapped[str] = mapped_column(String(255), nullable=False, unique=True)
+    description: Mapped[str] = mapped_column(Text, nullable=False)
+    instructions: Mapped[str] = mapped_column(Text, nullable=False)
+    allowed_tool_ids: Mapped[list[Any]] = mapped_column(JSONB, nullable=False, default=list)
+    context_policy: Mapped[dict[str, Any] | None] = mapped_column(JSONB, nullable=True)
+    category: Mapped[str] = mapped_column(String(100), nullable=False, default="general")
+    is_active: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now()
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), nullable=False, server_default=func.now(), onupdate=func.now()
+    )