Let a bot and a workspace set their own envs

Envs had three scopes, general, workspace and computer. A bot had no
scope of its own, so the only way to give one worker a key was to set it
on a computer it happened to share.

The envs table gets a bot_id, and resolution now layers bot over
computer over workspace over general, so a bot's own key wins wherever it
runs. Every computer call site passes the run's bot_id, and grabRunEnvs
does the same for the {{env.KEY}} a custom tool or an MCP server's headers
read.

A bot's and a workspace's settings page can now edit their own envs, in
place, through the same save-env and delete-env routes: sending `scoped`
makes them answer with just that scope instead of the whole install's
overview. Super admins only, like the Environment page.

src/types/index.ts

@@ -459,6 +459,7 @@ export type PublicEnv = {
     paradigm: EnvParadigm;
     workspace_id: number | null;
     computer_id: number | null;
+    bot_id: number | null;
     secret: boolean;
     expose_to_computers: boolean;
     value?: string;
@@ -469,8 +470,8 @@ export type PublicEnv = {
 };
 
 /**
- * Somewhere envs can be set: general, or one of the user's workspaces or
- * computers.
+ * Somewhere envs can be set: general, or one of the user's workspaces,
+ * computers or bots.
  */
 export type EnvScope = {
     paradigm: EnvParadigm;
@@ -478,6 +479,25 @@ export type EnvScope = {
     title: string;
 };
 
+/**
+ * One scope's envs, as a bot's or workspace's settings page sees them: the
+ * envs set there, and whether the viewer may change them.
+ */
+export type ScopedEnvsPayload = {
+    scope: EnvScope;
+    envs: PublicEnv[];
+    can_manage: boolean;
+};
+
+/**
+ * What saving or removing an env answers with: the Environment page's whole
+ * overview, or the one bot's or workspace's envs the settings pages show.
+ */
+export type EnvsMutationResult = {
+    overview?: EnvsOverviewPayload;
+    scoped?: ScopedEnvsPayload | null;
+};
+
 /**
  * An app setting on the Environment page: whether it's saved, or comes
  * from the server's environment instead.
@@ -982,6 +1002,12 @@ export type PagePropsType = {
      */
     bot_text_model?: BotTextModel | null;
     workspace_extensions?: BotExtensionsPayload | null;
+    /**
+     * The bot's own envs, or a workspace's (its settings page). Only a
+     * super admin gets them: envs are theirs to set.
+     */
+    bot_envs?: ScopedEnvsPayload | null;
+    workspace_envs?: ScopedEnvsPayload | null;
     envs?: {
         GOOGLE_CLIENT_ID?: string;
         R2_PUBLIC_DOMAIN?: string;