Add Qoder Forward template support

[heimanba]

What changed

• add declarative Qoder Forward Template materialization for agents
• route Forward session lifecycle operations through the Forward gateway with optional identity selection
• update CLI options, configuration/reference docs, and deployment guidance
• add focused unit coverage for Forward templates and session runtime behavior

Why

Qoder Forward-delivered agents need to be managed as templates and exercised through Forward sessions, while preserving existing Managed Agent behavior as the default.

Behavior / risk

Users can configure delivery.qoder.type: forward, apply and destroy the resulting Qoder Forward Template, and run local Forward sessions with either an explicit identity or the provisioned default identity. Managed Agent delivery remains the default when delivery is omitted.

The compatibility risk is concentrated in the shared resource graph, planner/executor dispatch, provider contracts, and session routing. Forward declarations materialize as template resources and cannot be referenced by managed deployments; existing managed declarations continue to materialize as agent resources.

Validation

• bun run verify:scoped
• bun run verify:push
• Qoder Forward Template unit coverage for graph materialization, create/update/archive, drift snapshots, identity resolution, and Forward session routing
• Server OpenAPI snapshot and generated WebUI API types refreshed and verified