P4: Agent-Identitäten ohne Secrets — sanitized config feed

- Replace Python-based sanitizer in deploy script with lightweight jq/alpine
- Add sync-agents-sanitized.mjs for on-demand and watch-mode sync
- Add AgentConfigPath to appsettings.json (explicit default)
- Extend /health/live endpoint to report agent count from sanitized config
- Document architecture in docs/agent-identity-architecture.md
- No openclaw.json secrets ever reach Nexus API containers

Verification:
- curl /api/v1/agents → 9 agents, zero secrets in response
- agents-sanitized.json contains only 'agents' key, no gateway/auth
- All C# code paths read from agents-sanitized.json (AgentConfigPath)
- Bridge controller resolves agent IDs via AgentService.GetAllowedAgentIdsAsync()

backend/Controllers/HealthController.cs

@@ -12,7 +12,26 @@ public class HealthController(IAgentRuntime runtime, HealthCheckService healthCh
     [HttpGet("/health/live")]
     public IResult Live()
     {
-        return Results.Ok(new { status = "Healthy", timestamp = DateTimeOffset.UtcNow });
+        var agentCount = 0;
+        try
+        {
+            var path = System.IO.Path.Combine(
+                System.IO.Path.GetDirectoryName(
+                    System.Reflection.Assembly.GetExecutingAssembly().Location) ?? "/app",
+                "..");
+            var configPath = "/home/node/.openclaw/agents-sanitized.json";
+            if (System.IO.File.Exists(configPath))
+            {
+                var json = System.IO.File.ReadAllText(configPath);
+                using var doc = System.Text.Json.JsonDocument.Parse(json);
+                if (doc.RootElement.TryGetProperty("agents", out var agentsEl)
+                    && agentsEl.TryGetProperty("list", out var listEl))
+                    agentCount = listEl.GetArrayLength();
+            }
+        }
+        catch { }
+
+        return Results.Ok(new { status = "Healthy", timestamp = DateTimeOffset.UtcNow, agentCount });
     }
 
     [HttpGet("/health")]