feat(plugins): add Agent Gateway plugin for workflow payment signing and credit checks

### Reason
Workflow authors and autonomous AI agents require a secure, non-custodial way to inspect their agentic wallet credit balance and produce Turnkey-backed payment signatures for KeeperHub marketplace workflows. The canonical HMAC endpoint contract (/api/agentic-wallet/sign and /api/agentic-wallet/credit) already exists on the platform, but there is currently no workflow plugin exposing these capabilities in workflow graphs.

### Scope
- **Included:**
- `plugins/agent-gateway` integration exposing `check-credit` and `sign-payment` steps.
- Secure credential fetching by `integrationId` for `AGENT_GATEWAY_SUB_ORG_ID` and `AGENT_GATEWAY_HMAC_SECRET`.
- Workflow-bound payment signing with required `workflowSlug` derivation.
- `docs/plugins/agent-gateway.md` documentation.
- Unit tests covering credit checks, payment signing, and connection verification.
- **Explicitly Excluded:**
- Raw private key access or Turnkey API key exposure to workflow steps.
- Arbitrary third-party 402 challenge signing without registry binding.

### Plan
1. Add `agent-gateway` plugin to `plugins/` with steps for `check-credit` and `sign-payment`.
2. Add `NEXT_PUBLIC_APP_URL` to `RUNNER_SYSTEM_ENV_VARS` to support K8s runner execution.
3. Decouple step signing logic from heavy database/KMS dependencies via pure HMAC signing.
4. Add unit test suite in `tests/unit/` verifying schema validation, HMAC signatures, and error envelopes.
5. Add documentation in `docs/plugins/agent-gateway.md`.

Start by reading the existing plugins/ structure, the /api/agentic-wallet/sign and /api/agentic-wallet/credit contract, and RUNNER_SYSTEM_ENV_VARS. Then inspect tests/unit/ and docs/plugins/agent-gateway.md targets; done means both workflow steps, credential verification, workflow-bound signing, connection checks, error/schema tests, runner configuration, and documentation are covered.

Written by the indexing model from the issue text.