Fix shared conversation agent authorization

[3em0]

Summary

• avoid publishing private or protected agent references when a conversation is shared
• re-authorize inherited public conversation agents before forked conversations keep them
• re-authorize conversation.agent before chat execution, prompt construction, and chat-model selection
• add regression coverage for share/fork/private-agent fallback behavior

Fixes #1327

Testing

• python3 -m py_compile src/khoj/database/adapters/__init__.py src/khoj/routers/api_chat.py src/khoj/routers/helpers.py tests/test_agents.py
• UV_PROJECT_ENVIRONMENT=/tmp/khoj-uv-venv uv run --extra dev ruff check src/khoj/database/adapters/__init__.py src/khoj/routers/api_chat.py src/khoj/routers/helpers.py tests/test_agents.py

Targeted pytest command attempted but the local environment has no usable PostgreSQL at localhost:5432; USE_EMBEDDED_DB=true also failed because pgserver could not initialize its local Postgres instance in this workspace.