Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

src/harness/tools/computer/search-computers-tool.ts

@@ -10,6 +10,10 @@ import type { HarnessTool } from "../../types";
 import runComputerCommand from "./run-computer-command";
 
 type Params = {
+    /**
+     * The bot the run is for: its own envs beat everything.
+     */
+    bot_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply.
      */
@@ -31,6 +35,7 @@ type Args = {
  * so the bot can tell the user exactly which computer holds what.
  */
 export default function searchComputersTool({
+    bot_id,
     workspace_id,
     computers,
 }: Params): HarnessTool<Args> {
@@ -59,7 +64,11 @@ export default function searchComputersTool({
                                 timeout_ms: AppData.ComputerSearchTimeoutMs,
                                 signal,
                             }),
-                            grabComputerEnvs({ computer_id: computer.id || 0, workspace_id }),
+                            grabComputerEnvs({
+                                computer_id: computer.id || 0,
+                                bot_id,
+                                workspace_id,
+                            }),
                         ]);
 
                         const output = redactSecrets({