feat(hooks): WS RPC surface + tenant-scope guards + shared test runner

Exposes agent hooks over WebSocket (hooks.list/create/update/delete/
toggle/test/history) behind existing auth layer. Additions:

- Gateway wiring: buildHookHandlers() factory reused by dispatcher and
  hooks.test runner, so UI test panel exercises production code paths
- GetByID tenant-scope guard: non-master callers only see own tenant +
  global rows (matches List() behavior on both PG and SQLite)
- i18n keys + catalogs (en/vi/zh) for hooks error messages
- Protocol method constants for hooks.* and config.defaults

pkg/protocol/methods.go

@@ -27,10 +27,11 @@ const (
 	MethodAgentsFileSet  = "agents.files.set"
 
 	// Config
-	MethodConfigGet    = "config.get"
-	MethodConfigApply  = "config.apply"
-	MethodConfigPatch  = "config.patch"
-	MethodConfigSchema = "config.schema"
+	MethodConfigGet      = "config.get"
+	MethodConfigApply    = "config.apply"
+	MethodConfigPatch    = "config.patch"
+	MethodConfigSchema   = "config.schema"
+	MethodConfigDefaults = "config.defaults"
 
 	// Sessions
 	MethodSessionsList    = "sessions.list"
@@ -193,3 +194,14 @@ const (
 	// WhatsApp
 	MethodWhatsAppQRStart = "whatsapp.qr.start"
 )
+
+// Agent hooks (Phase 3)
+const (
+	MethodHooksList    = "hooks.list"
+	MethodHooksCreate  = "hooks.create"
+	MethodHooksUpdate  = "hooks.update"
+	MethodHooksDelete  = "hooks.delete"
+	MethodHooksToggle  = "hooks.toggle"
+	MethodHooksTest    = "hooks.test"
+	MethodHooksHistory = "hooks.history"
+)