Preserve history with logical model and agent deletion

[Y1fe1Zh0u]

Summary

• replace physical Agent and model deletion with deleted_at logical deletion
• exclude deleted entities from active APIs, permissions, runtime entry points, schedulers, selectors, and background jobs
• preserve Chat, Run, Task, Audit, Participant, history, and workspace data after deletion
• cancel unfinished Agent runs, release workspace edit locks, and remove runtime containers on a best-effort basis
• add centralized active-model resolution with primary, fallback, and tenant-default candidates
• simplify model deletion in the frontend and expose deleted Group participants as historical records
• add an Alembic migration for nullable deletion timestamps and active-row partial indexes

Why

Physical deletion currently conflicts with existing foreign-key references and relies on destructive cleanup across historical data. Logical deletion makes an Agent or model unavailable everywhere it can be actively used while retaining the records needed to preserve history and auditability.

User and developer impact

• deleted Agents and models disappear from active selection and execution paths
• historical Group messages and participant references remain readable
• Agent workspace files remain in their original location
• deleting an in-use model no longer clears historical configuration references; runtime resolution falls back to another active model
• existing foreign keys are intentionally unchanged in this iteration

Validation

• backend full test suite: 1997 passed
• focused logical-deletion backend suite: 23 passed
• frontend tests: 63 passed
• frontend production build: passed
• Alembic heads: add_agent_model_deleted_at (head)
• staged diff check: passed

Migration note

Apply the new Alembic revision before deploying the application code. The migration adds nullable deleted_at columns and partial indexes; it does not remove or rewrite existing foreign keys.