App-callable backend functions with approval and validation flows

[omer-second]

Summary

• Adds top-level app tools for deterministic provider API calls and wires them into app code through the Second SDK.
• Improves agents.json approval handling, including versioned approval hashes, backend-function labeling, and clearer validation/error states.
• Updates builder guidance, runtime validation, and docs so invalid configs surface as fixable errors instead of empty approval cards.

Testing

• Ran targeted lint and typecheck checks for the updated web and worker code.
• Verified the invalid agents.json path now returns a structured validation error and the UI shows a warning-style error card instead of an empty approval state.
• Confirmed the app-tool approval flow still blocks only on successful presented configs and not on invalid validation results.