Add agent workflows & stuff

AGENTS.md

@@ -3,12 +3,17 @@
 ## Architecture
 
 - `apps/next`: Next.js 16 frontend.
+- `apps/agent-worker`: optional server-side coding-agent worker. It polls
+  Convex for queued jobs and may control Docker/Podman to run ephemeral job
+  containers.
 - `apps/expo`: Expo scaffold; only work here when explicitly requested.
 - `packages/backend/convex`: self-hosted Convex functions, schema, and auth.
 - `packages/ui`: shared shadcn-based UI components.
 - `tools`: shared ESLint, Prettier, Tailwind, TypeScript, and Vitest config.
 - Local development uses host-run apps, local Convex on ports 3210/3211, local
   Postgres on port 5432 for Convex storage, and the Convex dashboard on port 6791.
+  Agent jobs are opt-in; build `docker/agent-job.Dockerfile` as
+  `spoon-agent-job:latest` before running Docker-backed jobs.
 
 ## Protected and generated files
 
@@ -26,6 +31,10 @@
 - Run `infisical login` and `infisical init` before local development.
 - Machine-generated values belong in `.local/<env>.generated.env`; never put
   the generated Convex admin key in shared Infisical.
+- `scripts/sync-convex-env <dev|staging>` copies Authentik, GitHub App,
+  UseSend, `SITE_URL`, `SPOON_WORKER_TOKEN`, encryption, and Convex Auth signing
+  variables from Infisical into the selected Convex deployment. Backend
+  dev/setup scripts run it before `convex dev`.
 - CI uses Gitea-injected secrets or `CI_ENV_FILE` and must not call Infisical.
 - App code imports validated variables from `@/env`, never `process.env`.
 - Add cache-relevant variables to `turbo.json` `globalEnv`.
@@ -47,6 +56,8 @@
 ```sh
 bun db:up          # start Postgres, Convex, and dashboard
 bun dev:next       # host Next + deploy/watch local Convex functions
+bun dev:agent      # run the optional coding-agent worker on the host
+bun sync:convex    # sync Infisical values into Convex
 bun db:down        # stop and preserve local data
 bun db:down:wipe   # remove local data volumes and generated admin key
 ```