feat(harness): register macrod harnesses with device-code pairing

Makes user-run macrod daemons first-class harnesses: a harnesses entity
(private or team-owned), device-code pairing that mints a harness credential,
agents bound to a registered harness with ownership checks, the runtime
gateway rekeyed from bot to harness so one daemon serves every bound agent,
and the Settings UI to approve pairings and manage harnesses. The macrod TOML
is credential-free; identity comes from pairing, with scope (private/team)
requestable from config.

Author: ehayes2000

.gitignore

@@ -40,3 +40,9 @@ infra/local/generated/
 # Raw SSE captures from CURSOR_ACP_RECORD_DIR; sanitize into
 # crates/cursor_acp/fixtures/real/ before committing one.
 /recordings/
+
+# Per-developer macrod daemon config and the state files it writes next to
+# it (the credentials file holds this machine's harness bearer token).
+/macro.toml
+/macro.credentials.json
+/macro.webhook-state.json