fix(database): restrict db delete to agent-owning org (system agents admin-only)

- UI: delete button gated by canDeleteDatabases prop threaded from each page
  (org page: only org-created agents; admin page: system agents)
- authz: org path requires agent.organizationId === active org; drop join-based
  attribution so a system agent merely linked to an org is admin-delete-only

app/(customer)/dashboard/(admin)/agents/[agentId]/page.tsx

@@ -81,7 +81,7 @@ export default async function RoutePage(
         </PageDescription>
       )}
       <PageContent className="flex flex-col w-full h-full justify-between gap-6">
-        <AgentContentPage agent={agent} edgeKey={edgeKey} />
+        <AgentContentPage agent={agent} edgeKey={edgeKey} canDeleteDatabases={true} />
       </PageContent>
     </Page>
   );

app/(customer)/dashboard/(organization)/settings/agents/[agentId]/page.tsx

@@ -94,7 +94,7 @@ export default async function RoutePage(
                 </PageDescription>
             )}
             <PageContent className="flex flex-col w-full h-full justify-between gap-6">
-                <AgentContentPage agent={agent} edgeKey={edgeKey}/>
+                <AgentContentPage agent={agent} edgeKey={edgeKey} canDeleteDatabases={!!agent.organizationId}/>
             </PageContent>
         </Page>
     );