Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

src/main/services/provider-internal.ts

@@ -0,0 +1,101 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { ProviderAuthType } from "../../shared/domain";
+import { PROVIDER_CATALOG } from "../../shared/provider-catalog";
+import type { ProviderObservedRateLimitState } from "../../shared/provider-runtime-domain";
+import type { AuthBrokerService } from "./auth-broker-service";
+import type { ProviderAdapterRegistry } from "./provider-adapters";
+import type { ProviderRateLimitRegistry } from "./provider-rate-limit-registry";
+
+export const AUTH_STATE_CONFIGURED = "configured";
+export const AUTH_STATE_REVOKED = "revoked";
+export const HEALTH_STATE_HEALTHY = "healthy";
+export const HEALTH_STATE_FAILED = "failed";
+export const HEALTH_STATE_UNCHECKED = "unchecked";
+export const WORKSPACE_SCOPES = new Set(["organization", "workspace"]);
+
+export interface ProviderRow {
+  id: string;
+  provider_key: string;
+  auth_type: ProviderAuthType;
+  model: string | null;
+  credential_id: string | null;
+  enabled: number;
+  auth_state: string;
+  data_policy: string;
+  background_enabled: number;
+  monthly_request_limit: number;
+  workspace_scope: string;
+}
+
+export function loadConfiguredProvider(db: DatabaseSync, orgId: string, providerId: string): ProviderRow {
+  const provider = db.prepare(`
+    select id, provider_key, auth_type, model, credential_id, enabled, auth_state,
+      data_policy, background_enabled, monthly_request_limit, workspace_scope
+    from providers
+    where id = ? and org_id = ?
+  `).get(providerId, orgId) as ProviderRow | undefined;
+  if (!provider) throw new Error("Provider was not found.");
+  if (provider.enabled !== 1 || provider.auth_state !== AUTH_STATE_CONFIGURED) throw new Error("Provider credential is required.");
+  if (!provider.credential_id) throw new Error("Provider credential is required.");
+  return provider;
+}
+
+export function loadCredential(authBroker: AuthBrokerService, orgId: string, provider: ProviderRow): { secret: string } {
+  if (!provider.credential_id) throw new Error("Provider credential is required.");
+  return {
+    secret: authBroker.loadProviderSecret({
+      orgId,
+      providerId: provider.id,
+      providerKey: provider.provider_key,
+      credentialId: provider.credential_id,
+    }),
+  };
+}
+
+export function requireAdapter(
+  adapters: ProviderAdapterRegistry,
+  providerKey: string,
+  authType: string,
+): ProviderAdapterRegistry[string] {
+  const adapter = adapters[providerKey];
+  if (!adapter) throw new Error(`Provider adapter is unavailable for ${providerKey}.`);
+  if (adapter.authType !== authType) throw new Error(`Provider adapter auth type mismatch for ${providerKey}.`);
+  return adapter;
+}
+
+export function requireCatalogEntry(providerKey: string): (typeof PROVIDER_CATALOG)[number] {
+  const entry = PROVIDER_CATALOG.find((item) => item.key === providerKey);
+  if (!entry) throw new Error(`Provider catalog entry missing for ${providerKey}.`);
+  return entry;
+}
+
+export function recordProviderHealth(
+  db: DatabaseSync,
+  providerId: string,
+  orgId: string,
+  healthState: string,
+  error: string | null,
+): void {
+  db.prepare(`
+    update providers
+    set health_state = ?, last_error = ?, last_checked_at = ?
+    where id = ? and org_id = ?
+  `).run(healthState, error, new Date().toISOString(), providerId, orgId);
+}
+
+export function recordObservedRateLimit(
+  rateLimitRegistry: ProviderRateLimitRegistry,
+  orgId: string,
+  provider: Pick<ProviderRow, "id" | "provider_key">,
+  model: string | null,
+  state: ProviderObservedRateLimitState | null,
+): void {
+  if (!state) return;
+  rateLimitRegistry.recordObservation({
+    orgId,
+    providerId: provider.id,
+    providerKey: provider.provider_key,
+    model,
+    state,
+  });
+}