Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

tests/unit/provider-auth-broker-migration.test.ts

@@ -0,0 +1,79 @@
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { describe, expect, test } from "vitest";
+import { providerAuthBrokerSchema } from "../../src/main/database/migrations/021-provider-auth-broker";
+
+function createDatabase(): DatabaseSync {
+  return new DatabaseSync(join(tmpdir(), `agentcompany-auth-broker-migration-${randomUUID()}.db`));
+}
+
+describe("provider auth broker migration", () => {
+  test("backfills active auth profiles from configured credentials", () => {
+    const db = createDatabase();
+    db.exec(`
+      create table schema_migrations(version integer primary key, name text not null, applied_at text not null);
+      create table organizations(id text primary key);
+      create table providers(
+        id text primary key,
+        org_id text not null,
+        provider_key text not null,
+        auth_type text not null,
+        credential_id text
+      );
+      create table credentials(
+        id text primary key,
+        org_id text not null,
+        provider_key text not null,
+        kind text not null,
+        ciphertext blob not null,
+        display_hint text not null,
+        created_at text not null
+      );
+      insert into schema_migrations(version, name, applied_at) values (20, 'rollback_snapshots', datetime('now'));
+      insert into organizations(id) values ('org_1');
+      insert into credentials(id, org_id, provider_key, kind, ciphertext, display_hint, created_at)
+        values ('cred_1', 'org_1', 'openai', 'api_key', x'736563726574', 'sk-liv...ider', '2026-05-23T01:02:03.000Z');
+      insert into providers(id, org_id, provider_key, auth_type, credential_id)
+        values ('prov_1', 'org_1', 'openai', 'api_key', 'cred_1');
+    `);
+
+    db.exec(providerAuthBrokerSchema);
+
+    const profile = db.prepare(`
+      select org_id, provider_id, credential_id, provider_key, auth_type,
+        profile_kind, display_hint, source_type, capability_json, active, created_at
+      from provider_auth_profiles
+    `).get() as {
+      org_id: string;
+      provider_id: string;
+      credential_id: string;
+      provider_key: string;
+      auth_type: string;
+      profile_kind: string;
+      display_hint: string;
+      source_type: string;
+      capability_json: string;
+      active: number;
+      created_at: string;
+    };
+    const migration = db.prepare("select version, name from schema_migrations where version = 21").get();
+
+    expect(profile).toMatchObject({
+      org_id: "org_1",
+      provider_id: "prov_1",
+      credential_id: "cred_1",
+      provider_key: "openai",
+      auth_type: "api_key",
+      profile_kind: "api_key",
+      display_hint: "sk-liv...ider",
+      source_type: "migrated_credential",
+      active: 1,
+      created_at: "2026-05-23T01:02:03.000Z",
+    });
+    expect(JSON.parse(profile.capability_json)).toEqual({ providerKey: "openai", authType: "api_key", capabilityTags: [] });
+    expect(migration).toEqual({ version: 21, name: "provider_auth_broker" });
+    db.close();
+  });
+});