Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

src/dict/env-dict.ts

@@ -1,8 +1,8 @@
 import { HarnessProviderKinds } from "./harness-provider-dict";
 
 /**
- * Where an env applies. A computer's env beats a workspace's, which beats
- * a general one.
+ * Where an env applies. A bot's own env beats the computer it runs on,
+ * which beats the workspace it works in, which beats a general one.
  */
 export const EnvParadigms = [
     {
@@ -17,6 +17,10 @@ export const EnvParadigms = [
         title: "Computer",
         value: "computer",
     },
+    {
+        title: "Bot",
+        value: "bot",
+    },
 ] as const;
 
 export type EnvParadigm = (typeof EnvParadigms)[number]["value"];