fix(studio): enforce security boundaries

[evanlowe]

Summary

• restrict generated-agent debug endpoints and managed model credentials to trusted public HTTPS targets
• enforce same-origin OAuth redirects, role-gated resource discovery, and per-user local session/media ownership
• disable APIG-managed CORS for Studio deployments while preserving existing route configuration

Testing

• pre-commit run --all-files
• python -m pytest (1264 passed, 5 skipped)