新增智能体私密广场（is_private + 管理员密码门控）

- agents 表新增 is_private 列与迁移 20260526_01；列表 filter 拆分为公开
  广场用的 _listing_filter（剔除私密）与单条访问用的 _visible_filter（保留可达）
- system_settings 增 PrivateSquareSettings（enabled + password_hash），
  对应 GET/PUT /api/system-settings/private-square 由管理员管理
- /api/agents 接口：列表/创建/更新新增 is_private 字段；新增
  POST /api/agents/private-square/list（密码校验后返回私密智能体）与
  PUT /api/agents/{id}/private（管理员跨用户搬动智能体）
- 前端「智能体」页签新增「私密广场」入口（密码校验 + sessionStorage 缓存 +
  锁定按钮），卡片增加紫色私密徽章与盾牌切换按钮（owner 自助 / 管理员跨用户），
  「广场」与首页推荐候选均剔除私密智能体
- 新增管理员配置页 /settings/private-square 与侧边栏入口

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend-web/src/core/system-settings/api.ts

@@ -42,3 +42,45 @@ export async function updatePromptPrefixSettings(
   }
   return (await response.json()) as PromptPrefixSettings;
 }
+
+export interface PrivateSquareStatus {
+  enabled: boolean;
+  password_set: boolean;
+}
+
+export interface PrivateSquareUpdate {
+  enabled?: boolean;
+  password?: string;
+}
+
+export async function loadPrivateSquareStatus(): Promise<PrivateSquareStatus> {
+  const response = await apiFetch(
+    `${getBackendBaseURL()}/api/system-settings/private-square`,
+  );
+  if (!response.ok) {
+    throw new Error(
+      `Failed to load private square settings: ${response.status}`,
+    );
+  }
+  return (await response.json()) as PrivateSquareStatus;
+}
+
+export async function updatePrivateSquareSettings(
+  body: PrivateSquareUpdate,
+): Promise<PrivateSquareStatus> {
+  const response = await apiFetch(
+    `${getBackendBaseURL()}/api/system-settings/private-square`,
+    {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    },
+  );
+  if (!response.ok) {
+    const detail = await response
+      .json()
+      .catch(() => ({ detail: "Failed to update private square" }));
+    throw new Error(detail.detail ?? "Failed to update private square");
+  }
+  return (await response.json()) as PrivateSquareStatus;
+}