[codex] Add server-side Composio managed auth

[brandonkachen]

Summary

• Add Composio meta tools to the base/freebuff agent and expose them through SDK custom tool definitions.
• Route all Composio tool listing/execution through authenticated server endpoints so the Composio API key stays server-side.
• Persist Composio session IDs in Postgres and rehydrate sessions from DB when web process memory is cold.
• Add basic per-user rate limiting, structured logging, and endpoint/rate-limiter tests.

Validation

• bun --filter='{@codebuff/sdk,@codebuff/web,@codebuff/common,@codebuff/agents,@codebuff/internal}' run typecheck
• bun test web/src/app/api/v1/composio/__tests__/composio.test.ts web/src/server/__tests__/composio-rate-limiter.test.ts
• bun test agents/__tests__/base2.test.ts
• git diff --check

Notes

• This keeps the Composio API key on the web server and only sends the Codebuff API key from the SDK.
• Rate limiting is intentionally basic and in-memory per web process; use Redis/Postgres counters later if we need strict global limits.