Support per-agent outbound auth (headers) when routing to a registered agent URL

Problem

When the orchestrator routes to an agent declared under agents: [{ id, url }], there is no way to attach credentials to that outbound call. The agent schema is { id, url } with additionalProperties: false, so an agent whose endpoint requires authentication (e.g. Authorization: Bearer <token>) rejects Plano's request with a 401.

model_providers / llm_providers already support headers and passthrough_auth for their upstream calls, but agent routing has no equivalent — so credentialed agents can be routed to, but never authenticated to.

Use case

A governance platform registers teams' existing ("bring-your-own") agents by URL and routes to them through Plano. Those endpoints are protected, so the orchestrator needs to present a per-agent token when it calls each one. Today the token can be stored alongside the agent record, but there is no config surface to make Plano send it.

Proposal

Add an optional auth config to an agent entry, mirroring the pattern that already exists for model/LLM providers so it stays consistent:

agents:
  - id: billing_agent
    url: http://billing-agent.team-x:8080
    headers:
      Authorization: "Bearer ${BILLING_AGENT_TOKEN}"   # env/secret ref, not inline

Ideally:

• values resolvable from an env var / secret reference rather than committed inline,
• and/or a passthrough_auth-style flag to forward the caller's Authorization header, matching the existing provider option.