feat: add gateway bootstrap endpoint with token-based authentication

Add Bootstrap and AgentSyncBundle handlers to gateway package with X-Gateway-Bootstrap-Token header authentication. Implement UpsertByName repository method for idempotent gateway registration. Update gateway entrypoint script to auto-generate keys and bootstrap gateway on first run, persisting gateway ID to disk. Add GATEWAY_BOOTSTRAP_TOKEN config and update environment variables for gateway name, bootstrap URL, and sync URL.

backend/internal/gateway/service.go

@@ -39,3 +39,19 @@ func (s *Service) Update(ctx context.Context, gatewayID string, input UpdateRequ
 	}
 	return s.repo.Update(ctx, id, input)
 }
+
+func (s *Service) Bootstrap(ctx context.Context, input BootstrapRequest) (Gateway, error) {
+	if input.Name == "" {
+		input.Name = "primary-gateway"
+	}
+	if input.ListenPort == 0 {
+		input.ListenPort = 51820
+	}
+	if input.VPNCIDR == "" {
+		input.VPNCIDR = "100.96.0.0/24"
+	}
+	if len(input.DNSServers) == 0 {
+		input.DNSServers = []string{"10.20.0.53"}
+	}
+	return s.repo.UpsertByName(ctx, input)
+}