feat: agent 本机 SimAdmin 登录与会话维持；中继设备侧限流与 agent Retry-After

- runtime.NodeAuth：agent 自查 /api/auth/status，需要时自行 POST /api/auth/login 并持
  simadmin_session Cookie 转发；错误密码进入 60s 冷却（对齐控制台 ensureAuthenticated），
  节点回 401/403 即失效重探，SimAdmin 重启无需重启 agent
- 节点密码进 agent 配置（nodePassword），永不经中继、永不下发到手机；登录路径仍被策略
  挡在电话可达面之外（TestAuthPathsAreUnreachable）
- 新拒绝分类 node_auth_failed：与 upstream_error 区分，手机可提示'该节点需重新配置'
- 中继：/v1/request 每设备固定窗口限流（默认 30/分钟），未鉴权调用不消耗预算
- transport：解析 Retry-After 并入退避；main loop 对 429 直接遵从中继指示
- contracts/envelope.schema.json 补 InnerResponse.outcome 字段
- 设计文档与 README 同步：WSS 改为长轮询的实现修订、响应方向已临时×临时、P2/P3 状态

cmd/msa-agent/main.go

@@ -98,8 +98,9 @@ func run(configPath string, checkOnly, once bool) error {
 	defer audit.Close()
 
 	exec, err := runtime.NewExecutor(pol, runtime.Config{
-		Port:  cfg.LocalPort,
-		Audit: audit,
+		Port:         cfg.LocalPort,
+		Audit:        audit,
+		NodePassword: cfg.NodePassword,
 	})
 	if err != nil {
 		return err
@@ -151,6 +152,10 @@ func loop(ctx context.Context, node *agent.Agent, client *transport.Client, pol
 			// a tight loop against the relay.
 			slog.Warn("relay rejected the agent session, re-authenticating", "error", err)
 			backoff = minBackoff * 5
+		case errors.Is(err, transport.ErrRateLimited):
+			// The relay said how long to wait; doubling its own backoff on top of that would be
+			// the agent overriding an explicit instruction.
+			backoff = client.RetryAfter()
 		default:
 			slog.Warn("poll cycle failed", "error", err, "retryIn", backoff)
 			backoff = next(backoff)