Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

db/schema.ts

@@ -2467,7 +2467,7 @@ const schema: BUN_SQLITE_DatabaseSchemaType = {
                 },
                 {
                     fieldName: "paradigm",
-                    fieldDescription: `Where it applies: general, a workspace, or a computer. Computer beats workspace beats general`,
+                    fieldDescription: `Where it applies: general, a workspace, a computer, or a single bot. A bot's own beats the computer, which beats the workspace, which beats general`,
                     dataType: "TEXT",
                     options: EnvParadigms.map((p) => p.value),
                     defaultValue: "general",
@@ -2496,6 +2496,18 @@ const schema: BUN_SQLITE_DatabaseSchemaType = {
                         foreignKeyName: "envs_computer_fk",
                     },
                 },
+                {
+                    fieldName: "bot_id",
+                    fieldDescription: `The bot, for paradigm bot. Goes with the bot`,
+                    dataType: "INTEGER",
+                    foreignKey: {
+                        cascadeDelete: true,
+                        destinationTableName: "bots",
+                        destinationTableColumnName: "id",
+                        destinationTableColumnType: "INTEGER",
+                        foreignKeyName: "envs_bot_fk",
+                    },
+                },
                 {
                     fieldName: "secret",
                     fieldDescription: `1 hides the value once saved (only replaced, never shown) and redacts it from everything bots read`,