multi-tenant phase 3: per-user Home Assistant + enrolled services

- tools/home_assistant.py: remove hardcoded URL/token; read from per-user
  config injected via set_ha_config() at invocation time; return helpful
  enrollment prompt when HA not configured
- main.py: inject HA config from user_profile.services at startup; add
  manage_service tool (enroll/remove/list) that persists to DynamoDB;
  show enrolled services in user context; add USERS_TABLE_NAME env var
- agent-runner/handler.py: pass services dict from DDB user record in
  user_profile payload; initialize services={} for new users
- cdk/lib/agent-claw-stack.ts: grant usersTable read/write to runtime1Role
  so manage_service tool can update user records
- agentclaw/agentcore/agentcore.json: add USERS_TABLE_NAME env var

src/lambdas/agent-runner/handler.py

@@ -42,6 +42,7 @@ def get_or_create_user(actor_id: str, from_info: dict) -> dict:
         'telegram_username': from_info.get('from_username', ''),
         'created_at': str(now),
         'status': 'pending',
+        'services': {},
     }
     table.put_item(Item=item)
     print(f'[agent-runner] Registered new user (pending): {actor_id}')
@@ -163,6 +164,7 @@ def handler(event, context):
             'telegram_username': user_profile.get('telegram_username', ''),
             'google_email': user_profile.get('google_email', ''),
             'allowed': user_profile.get('allowed', True),
+            'services': user_profile.get('services', {}),
         },
         'channel_adapter': {
             'type': channel,