refactor(agents): hoist subagent middleware-stack recipe into main_agent

subagents/shared/middleware/ held build_subagent_middleware_stack, but no
subagent package imports it -- its only caller is main_agent/middleware/stack.py
(the generic pack_subagent builder merely consumes the resulting dict at
runtime). It is main_agent's policy for which middleware to thread into
subagents, so it belongs with its caller:

  subagents/shared/middleware/middleware_stack.py
  -> main_agent/middleware/subagent_stack.py

subagents/shared/ now holds only genuinely subagent-shared code (md_file_reader,
snippets, spec, subagent_builder, hitl).

surfsense_backend/app/agents/chat/multi_agent_chat/main_agent/middleware/stack.py

@@ -53,9 +53,6 @@ from app.agents.chat.multi_agent_chat.subagents.builtins.knowledge_base.agent im
 from app.agents.chat.multi_agent_chat.subagents.builtins.knowledge_base.ask_knowledge_base_tool import (
     build_ask_knowledge_base_tool,
 )
-from app.agents.chat.multi_agent_chat.subagents.shared.middleware.middleware_stack import (
-    build_subagent_middleware_stack,
-)
 from app.db import ChatVisibility
 
 from .action_log import build_action_log_mw
@@ -77,6 +74,9 @@ from .noop_injection import build_noop_injection_mw
 from .otel_span import build_otel_mw
 from .plugins import build_plugin_middlewares
 from .skills import build_skills_mw
+from .subagent_stack import (
+    build_subagent_middleware_stack,
+)
 from .tool_call_repair import build_repair_mw