fix: agent update API missing is_default, budget, subagents fields (#270)

The HTTP allowlist (agentAllowedFields) was missing three fields that
the web UI sends when saving agent settings: is_default,
budget_monthly_cents, and subagents_config. These fields were silently
filtered out by filterAllowedKeys(), so saves appeared successful but
values never persisted to the database.

Also adds exclusive-default logic: when setting is_default=true on an
agent, any previously-default agent is automatically unset first.

Co-authored-by: Luvu182 <208665161+Luvu182@users.noreply.github.com>

internal/http/validate.go

@@ -38,6 +38,7 @@ var agentAllowedFields = map[string]bool{
 	"workspace": true, "restrict_to_workspace": true,
 	"frontmatter": true, "compaction_config": true,
 	"memory_config": true, "other_config": true, "tools_config": true,
+	"is_default": true, "budget_monthly_cents": true, "subagents_config": true,
 }
 
 var providerAllowedFields = map[string]bool{

internal/store/pg/agents.go

@@ -164,6 +164,17 @@ func (s *PGAgentStore) Update(ctx context.Context, id uuid.UUID, updates map[str
 	if len(updates) == 0 {
 		return nil
 	}
+
+	// If setting this agent as default, unset any existing default first.
+	if v, ok := updates["is_default"]; ok {
+		if isDefault, _ := v.(bool); isDefault {
+			if _, err := s.db.ExecContext(ctx,
+				"UPDATE agents SET is_default = false WHERE is_default = true AND id != $1 AND deleted_at IS NULL", id); err != nil {
+				slog.Warn("agents.unset_default", "error", err)
+			}
+		}
+	}
+
 	updates["updated_at"] = time.Now()
 	err := execMapUpdateWhere(ctx, s.db, "agents", updates, "id = $IDX AND deleted_at IS NULL", id)
 	if err != nil {