Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

src/harness/tools/extensions/open-bot-extensions.ts

@@ -51,7 +51,7 @@ export default async function openBotExtensions({
 
     if (!servers.length && !tools.length) return { tools: [], note: "", close: async () => {} };
 
-    const envs = await grabRunEnvs({ workspace_id });
+    const envs = await grabRunEnvs({ bot_id, workspace_id });
     const secrets = envs.filter((env) => env.secret);
     const redact = (text: string) => redactSecrets({ text, secrets });
     const names = new Set(taken);