feat(agent-providers): non-interactive right agent providers add CLI

[de4ps]

Provider management has been dashboard-only since v0.3.0 — agents, fleet operators, and automation tools that drive right programmatically have no way to attach a provider without going through the Telegram Mini App. The new subcommand fills that gap by exposing the same internal-socket REST API the dashboard uses, with the validation, locking, and gateway-side rollback that path already provides:

RIGHT_PROVIDER_CREDENTIAL=<token> \
  right agent providers add my-agent \
    --type generic \
    --label litellm \
    --upstream-host litellm.example.com \
    --header-name x-api-key \
    --env-var ANTHROPIC_API_KEY

Built-in profiles work the same way without the generic-only flags:

RIGHT_PROVIDER_CREDENTIAL=<token> \
  right agent providers add my-agent \
    --type github --label gh

The credential value is taken from the RIGHT_PROVIDER_CREDENTIAL environment variable rather than --credential value-flag when both are absent on argv — passing secrets via argv leaks them to ps, shell history, and journald, the same anti-pattern this codebase already avoids for telegram tokens (see right init --telegram-token, which also accepts RIGHT_TELEGRAM_TOKEN). hide_env_values = true keeps the env var out of --help output.

Requires right up to be running (the subcommand talks to ~/.right/run/internal.sock) and emits a clear error pointing at right up when the socket is absent. Output is the same ProviderView JSON the dashboard sees, so callers can pipe to jq.

This is intended for fleet automation where the dashboard is not the control plane (e.g. a multi-tenant registrar provisioning agents on a shared host). Dashboard-driven workflows are unchanged.