feat: agent devices/sessions filter by agent-associated users only

- Add created_by field to AppUser model to track who created the user
- Set created_by when agent creates users
- Extract getAgentUserIDs() helper: finds users who recharged with agent/sub-agent cards OR were created by agent/sub-agent
- Extract getAgentAppIDs() helper: finds agent's authorized applications
- Refactor handleGetUsers and checkAgentUserPermission to use getAgentUserIDs
- Create agent-specific handleGetDevices: filter by agent user IDs + app IDs
- Create agent-specific handleGetSessions: filter by agent user IDs + app IDs
- Replace admin handler references with agent-specific handlers for GET routes

backend/internal/model/models.go

@@ -61,6 +61,7 @@ type AppUser struct {
 	IsTrialUser     bool           `gorm:"default:false" json:"is_trial_user"`
 	TrialStartAt    *time.Time     `json:"trial_start_at"`
 	TrialEndAt      *time.Time     `json:"trial_end_at"`
+	CreatedBy       *uint          `gorm:"index" json:"created_by"`
 	CreatedAt       time.Time      `json:"created_at"`
 	UpdatedAt       time.Time      `json:"updated_at"`
 	DeletedAt       gorm.DeletedAt `gorm:"index" json:"-"`