feat: switch agent identity from openclaw.json to agents-sanitized.json

Completes P4 migration: Nexus API no longer reads openclaw.json.

Changes:
- AgentService: default path -> agents-sanitized.json
- OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels
  both now read from agents-sanitized.json
- compose.yaml: mount agents-sanitized.json instead of openclaw.json

The deploy script (.gitea/scripts/deploy-nexus.sh) already generates
agents-sanitized.json during deployment, extracting only the
section (list + defaults) without gateway/auth/password secrets.

DoD:
- No read access to openclaw.json from Nexus API container
- No uid-1654 ACL dependency for agent identity resolution
- No secrets in agent responses or config files

compose.yaml

@@ -68,7 +68,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/openclaw.json:/home/node/.openclaw/openclaw.json:ro
+      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/home/node/.openclaw/agents-sanitized.json:ro
       - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
       - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
       - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer