Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

src/main/services/provider-auth-lifecycle.ts

@@ -0,0 +1,43 @@
+import type { ProviderAuthProfile } from "./provider-adapters";
+
+export interface ProviderAuthorizeInput {
+  secret: string;
+}
+
+export interface ProviderAuthorizeResult {
+  authProfile: ProviderAuthProfile;
+}
+
+export interface ProviderRefreshInput {
+  authProfile: ProviderAuthProfile;
+}
+
+export interface ProviderRefreshResult {
+  authProfile: ProviderAuthProfile;
+  rotatedSecret: string | null;
+  refreshedAt: string;
+}
+
+export interface ProviderRevokeInput {
+  authProfile: ProviderAuthProfile;
+}
+
+export type ProviderAuthorizeHandler = (input: ProviderAuthorizeInput) => Promise<ProviderAuthorizeResult>;
+export type ProviderRefreshHandler = (input: ProviderRefreshInput) => Promise<ProviderRefreshResult>;
+export type ProviderRevokeHandler = (input: ProviderRevokeInput) => Promise<void>;
+
+export function authorizeWithParser(parseAuthProfile: (secret: string) => ProviderAuthProfile): ProviderAuthorizeHandler {
+  return async (input) => ({ authProfile: parseAuthProfile(input.secret) });
+}
+
+export function refreshUnsupported(label: string): ProviderRefreshHandler {
+  return async () => {
+    throw new Error(`${label} does not support token refresh.`);
+  };
+}
+
+export function revokeLocalProfile(assertProfile: (profile: ProviderAuthProfile) => void): ProviderRevokeHandler {
+  return async (input) => {
+    assertProfile(input.authProfile);
+  };
+}