fix(ui): preserve byProvider in tools_config whitelist on save

The PR #153 whitelist stripped byProvider on agent config save,
but byProvider is actively used in policy.go for per-provider
tool overrides. Add it to the whitelist and ToolPolicyConfig type.

ui/web/src/pages/agents/agent-detail/agent-config-tab.tsx

@@ -78,7 +78,7 @@ export function AgentConfigTab({ agent, onUpdate }: AgentConfigTabProps) {
       const updates: Record<string, unknown> = {
         subagents_config: subEnabled ? sub : null,
         tools_config: toolsEnabled
-          ? { profile: tools.profile, allow: tools.allow, deny: tools.deny, alsoAllow: tools.alsoAllow }
+          ? { profile: tools.profile, allow: tools.allow, deny: tools.deny, alsoAllow: tools.alsoAllow, byProvider: tools.byProvider }
           : {},
         compaction_config: comp,
         context_pruning: pruneEnabled ? prune : null,

ui/web/src/types/agent.ts

@@ -7,6 +7,7 @@ export interface ToolPolicyConfig {
   allow?: string[];
   deny?: string[];
   alsoAllow?: string[];
+  byProvider?: Record<string, { profile?: string; allow?: string[]; deny?: string[]; alsoAllow?: string[] }>;
 }
 
 export interface SubagentsConfig {