feat: switch agent identity from openclaw.json to agents-sanitized.json

Completes P4 migration: Nexus API no longer reads openclaw.json.

Changes:
- AgentService: default path -> agents-sanitized.json
- OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels
  both now read from agents-sanitized.json
- compose.yaml: mount agents-sanitized.json instead of openclaw.json

The deploy script (.gitea/scripts/deploy-nexus.sh) already generates
agents-sanitized.json during deployment, extracting only the
section (list + defaults) without gateway/auth/password secrets.

DoD:
- No read access to openclaw.json from Nexus API container
- No uid-1654 ACL dependency for agent identity resolution
- No secrets in agent responses or config files

backend/Services/AgentService.cs

@@ -235,7 +235,7 @@ public sealed class AgentService(IConfiguration configuration, IAgentRuntime run
     private async Task<IReadOnlyList<AgentConfig>> LoadAgentConfigsAsync(CancellationToken cancellationToken)
     {
         var path = configuration.GetValue<string>("AgentConfigPath")
-            ?? "/home/node/.openclaw/openclaw.json";
+            ?? "/home/node/.openclaw/agents-sanitized.json";
 
         if (!File.Exists(path))
             return BuildFallbackConfigs();