Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

db/types/db.ts

@@ -1516,9 +1516,9 @@ export type BUN_SQLITE_COBBLE_ENVS = {
      */
     description?: string;
     /** 
-     * Where it applies: general, a workspace, or a computer. Computer beats workspace beats general
+     * Where it applies: general, a workspace, a computer, or a single bot. A bot's own beats the computer, which beats the workspace, which beats general
      */
-    paradigm?: "general" | "workspace" | "computer" | "";
+    paradigm?: "general" | "workspace" | "computer" | "bot" | "";
     /** 
      * The workspace, for paradigm workspace
      */
@@ -1527,6 +1527,10 @@ export type BUN_SQLITE_COBBLE_ENVS = {
      * The computer, for paradigm computer
      */
     computer_id?: number | "";
+    /** 
+     * The bot, for paradigm bot. Goes with the bot
+     */
+    bot_id?: number | "";
     /** 
      * 1 hides the value once saved (only replaced, never shown) and redacts it from everything bots read
      */