feat: Generic CRM API tool - AI can control entire system

- Create call_crm_api tool: single tool that can call ANY CRM API endpoint
- Inject OpenAPI spec into system prompt so AI knows all available endpoints
- Always include call_crm_api in agent tools (not just via tool_ids)
- Extend get_current_user to support internal header-based auth (X-Internal-Call,
  X-Tenant-Id, X-User-Id) for AI tool API access
- No more manual tool-per-endpoint registration needed

app/plugins/builtins/ai_assistant/services.py

@@ -308,6 +308,13 @@ async def build_litellm_params(
     # Build messages with system prompt
     litellm_messages = []
     if system_prompt:
+        # Inject CRM API context into system prompt
+        try:
+            from app.plugins.builtins.ai_assistant.crm_api_tool import get_api_context_for_prompt
+            api_context = await get_api_context_for_prompt()
+            system_prompt = system_prompt + api_context
+        except Exception:
+            logger.warning("Failed to inject API context into system prompt")
         litellm_messages.append({"role": "system", "content": system_prompt})
     litellm_messages.extend(messages)
 
@@ -427,9 +434,13 @@ async def stream_chat(
     messages.append({"role": "user", "content": full_message})
     await save_message(db, session.id, "user", user_message, tenant_id)
 
-    # Get agent tools
+    # Get agent tools — always include call_crm_api for full system access
     registry = get_tool_registry()
     tools = registry.get_by_names(agent.tool_ids or [])
+    # Ensure call_crm_api is always available
+    crm_api_tool = registry.get("call_crm_api")
+    if crm_api_tool and crm_api_tool not in tools:
+        tools.append(crm_api_tool)
     tool_schemas = [t.to_openai_schema() for t in tools] if tools else None
 
     # Build LLM params