feat: JWT token generation API + auto-inject TORI_JWT in executor

- POST /tori/api/token — sign ES256 JWT with configurable private key
- exec.rs auto-generates and injects TORI_JWT env var for all commands
- Config: jwt_private_key field for PEM file path

src/agent.rs

@@ -79,6 +79,7 @@ pub struct AgentManager {
     llm_config: LlmConfig,
     template_repo: Option<crate::TemplateRepoConfig>,
     kb: Option<Arc<crate::kb::KbManager>>,
+    jwt_private_key_path: Option<String>,
 }
 
 impl AgentManager {
@@ -87,6 +88,7 @@ impl AgentManager {
         llm_config: LlmConfig,
         template_repo: Option<crate::TemplateRepoConfig>,
         kb: Option<Arc<crate::kb::KbManager>>,
+        jwt_private_key_path: Option<String>,
     ) -> Arc<Self> {
         Arc::new(Self {
             agents: RwLock::new(HashMap::new()),
@@ -97,6 +99,7 @@ impl AgentManager {
             llm_config,
             template_repo,
             kb,
+            jwt_private_key_path,
         })
     }
 
@@ -177,7 +180,7 @@ async fn agent_loop(
     let pool = mgr.pool.clone();
     let llm_config = mgr.llm_config.clone();
     let llm = LlmClient::new(&llm_config);
-    let exec = LocalExecutor::new();
+    let exec = LocalExecutor::new(mgr.jwt_private_key_path.clone());
     let workdir = format!("/app/data/workspaces/{}", project_id);
 
     tracing::info!("Agent loop started for project {}", project_id);