feat: purge legacy agent hosts and land vault Chrome extension path

Retire ACP/Hermes/OpenCode surfaces and rename hermes_tools to
mnote_agent_tools so Page AI stays on Pi Lab only. Add Chrome vault
extension + extension token route, pre-release purge design, and soft-retire
legacy smokes for the small-group production cut.

rust/Cargo.lock

@@ -2424,6 +2424,8 @@ dependencies = [
  "control-plane",
  "core-protocol",
  "futures-util",
+ "hex",
+ "hmac",
  "hyper 1.10.1",
  "hyper-util",
  "leptos",
@@ -2434,6 +2436,7 @@ dependencies = [
  "rusqlite",
  "serde",
  "serde_json",
+ "sha2",
  "time",
  "tokio",
  "tokio-stream",