Let a hidden coworker be found again on the Agents screen

[asasemahmed]

What this changes

Part of #323. Hide and Duplicate already exist; what was missing is a way back from Hide.
Hiding a coworker takes it off both lists on /agents, and Unhide is only in the coworker's
dialog, which only its card opens. Once hidden, a coworker could only be reached again by typing
/agents?agent=<id> by hand.

The Agents screen now ends with a collapsed Hidden section listing hidden coworkers. Each card
opens the same dialog, where Unhide already is. The section renders nothing while loading, on a
failed request, or when nothing is hidden, so the screen is unchanged for anyone who has never
hidden anything and the existing loading and error states are untouched.

Pin, the other half of #323, is not in this PR. It needs a column beside hidden_at and its own
audited actions, so it belongs in a change of its own.

Where it runs

• New state that outlives a request? None. The screen reads GET /api/agents?hidden=true,
  which the server already serves from agent_preferences.hidden_at.
• What happens on the second replica? Nothing different: the read is served from Postgres
  by whichever replica answers.
• Anything serialised? No.
• Anything fanned out to a browser? No. The existing mutations already invalidate
  agentKeys.all, which covers the hidden list, so Hide and Unhide move the card between
  sections without a reload.
• New listener, port, or schedule? No.

Boundary and audit

• Every acting call still goes through the gateway: no new acting call. Hide and Unhide are the
  existing routes, still recorded as bot.hidden / bot.unhidden.
• New refusals and new failures each write a row: none added.
• Nothing new is trusted from the client: the list is the server's own, scoped to the caller.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

• bun test app/tests/agent-roster-error.test.tsx: 12 pass. Two new tests: a hidden coworker
  appears under a collapsed Hidden section with a card linking to its dialog, and no section
  renders when nothing is hidden. Both fail against main.
• bun run --filter app typecheck, biome lint, biome format: clean.
• Manually, on a local stack: hid Risk Analyst from its dialog, saw it leave Explore agents and
  appear under Hidden, opened it from there, unhid it, and saw the section disappear.

@yash-santosh-dhumal offered to take #323 earlier. This covers only the Hidden-list gap, so Pin
is still open if you are working on it.