M3 — Persistent Session Model:
  DB:
  - Session model: +sync_workspace_id, +attached_node_ids (JSON), +node_sync_status (JSON)
  - Migration: auto-adds 3 new columns to existing sessions table
  API (sessions router):
  - POST /sessions/        now auto-attaches user's default_node_ids from preferences
    on creation, generates sync_workspace_id, seeds 'pending' sync status
  - POST /sessions/{id}/nodes       attach nodes to an existing session
  - DELETE /sessions/{id}/nodes/{node_id}   detach a node
  - GET  /sessions/{id}/nodes       live sync status (merges DB + live registry)
  Schemas: NodeAttachRequest, NodeSyncStatusEntry, SessionNodeStatusResponse

M4 — Invite Token Validation:
  API (nodes router):
  - GET  /nodes/admin/{id}/config.yaml  generate ready-to-deploy agent_config.yaml
    (contains node_id, hub_url, grpc_endpoint, invite_token, skill toggles)
  - POST /nodes/validate-token          internal endpoint called by gRPC server;
    validates token against DB, returns skill_config for SandboxPolicy
  gRPC (grpc_server.py):
  - SyncConfiguration now calls POST /nodes/validate-token before registering node
  - HUB_API_URL env var controls this; empty = dev mode (skip validation)
  - Shell skill disabled by admin → empty allowed_commands in SandboxPolicy
  - Gracefully degrades if Hub is unreachable (logs warning, proceeds in dev)