fix(cli): ncl groups delete cascades + auto-IDs survive OneCLI validation

[abarbaccia]

Summary

Two coupled bugs that surface together the moment you create a brand-new agent group via `ncl groups create` and try to clean it up.

1. `ncl groups delete` always fails with FOREIGN KEY constraint failed

`genericDelete` in `src/cli/crud.ts` ran `DELETE FROM ${table}` directly. That's fine for leaf rows, but `agent_groups` has FK references with no `ON DELETE CASCADE` from `sessions`, `messaging_group_agents`, `agent_group_members`, `user_roles`, `agent_destinations`, and a few pending-approval tables. Result: once a session row exists for the group, `ncl groups delete` errors forever and there's no `ncl` verb to clean it up.

Fix:

• New optional `customDelete?: (id: string) => number` hook on `ResourceDef`.
• `groups` resource wires it to `deleteAgentGroup`, which walks every dependent table in a single transaction (delete sessions/wirings/members/roles/destinations/pending sender + channel approvals; null-out `pending_approvals.agent_group_id`; then delete the group).
• `genericDelete` falls back to the raw SQL when `customDelete` is not set — every other resource is unchanged.

2. Auto-generated agent group IDs are rejected by OneCLI

`genericCreate` generates IDs via `randomUUID()`. UUIDs start with a digit ~62% of the time. OneCLI's `POST /api/agents` validates `identifier` against `^[a-z][a-z0-9-]{0,49}$` and returns 400 Bad Request. The host's first wakeContainer call then fails forever:
```
OneCLIRequestError: [URL=…/api/agents] [StatusCode=400] OneCLI returned 400 Bad Request
```
Repro: `./bin/ncl groups create --name Foo --folder foo` — any UUID starting with a digit. Symptom is silent — the host just keeps retrying on every sweep.

Fix:

• New optional `idPrefix?: string` on `ResourceDef`. Auto-generated IDs become `${idPrefix}${randomUUID()}`.
• `groups` resource sets `idPrefix: 'ag-'` so auto-IDs are always OneCLI-safe.
• `genericCreate` now also honors an explicit `--id` if the caller provides one (previously `generated: true` silently dropped user input), so you can pass `--id ag-shopping` for a readable identifier.

Test plan

• Added `cascades through sessions and wirings on delete` test — creates an agent group, messaging group, wiring, and session; calls `deleteAgentGroup`; asserts they're all gone.
• `pnpm exec vitest run src/db/db-v2.test.ts` — 33/33 pass.
• `pnpm run build` — clean tsc.
• Manual end-to-end:
  • `ncl groups create --id ag-shopping --name "Homey - Shopping" --folder shopping` → group created with the literal ID
  • Wired a WhatsApp messaging group, host spawned the container on the first message (no more 400 from OneCLI).
  • `ncl groups delete --id ` on a group with active sessions + wiring → clean delete, no FK error.

🤖 Generated with Claude Code