fix: enable Automatic Learning and provision its default container

[davidmckayv]

Automatic Learning previously defaulted off and fresh setup had no Learning container. Fresh managed and self-hosted setup now creates or reuses the selected project's openbot container and saves the matching runtime key and target. Saved opt-outs, explicit empty defaults, custom targets, and per-agent settings remain authoritative.

Desktop setup and scripts/setup-learning.ts both support this. Self-hosted setup uses Intelligence's existing SSO in a temporary Chrome/Edge window; it requires one of those browsers on the setup computer and persists no management session. Existing manually supplied runtime keys are preserved. No Intelligence source changes or upgrade are required; self-hosted API compatibility was verified against release 0.11.2. README, setup prompt, environment example, and deployment documentation are updated.

Validation (CI green on 7cca0678; all 20 executed checks passed):

• Live managed API: actual native and CLI create/reuse, matching key/target configuration.
• Real self-hosted Intelligence 0.11.2 + Keycloak: Auth.js/OIDC HTTP sign-in, production helper creation from an empty project, reuse without another container POST, and actual clone setup saving private configuration with byte-identical repeat preservation. This is HTTP integration evidence, not visual desktop proof.
• Real native cancellation: started the actual helper and Chrome, cancelled, and verified the helper and browser descendants exited.
• Regression checks: 19 setup tests; 5 new native tests; 97 existing desktop UI cases and 3 new cases; previously accepted settings/runtime/PostgreSQL persistence coverage. TypeScript, Biome, Rust formatting/clippy, desktop frontend and native builds pass.
• Browser UI check: completed the real enterprise SSO form and returned successfully to Intelligence using the isolated test account.
• Still pending: the full desktop-to-temporary-browser-to-project handoff. The native controller cannot select the separate Chrome process opened by the helper. The standalone browser sign-in, HTTP integration, and native cancellation checks do not substitute for this remaining end-to-end check.

Fixes FOR-326

[linear-code]

FOR-326