refactor(agents): move tools package to app/agents/shared (slice 6)

Relocate the entire new_chat/tools/ package (62 files incl. registry, hitl, MCP
cluster, and all connector subpackages: gmail/slack/discord/teams/drive/etc.)
to the shared kernel. The package turned out to be a clean cohesive cluster:
its only references to non-tools new_chat modules were comments, and its
middleware deps were already flipped to shared in slice 5c.

Flip 33 live importers (multi-agent, flows, routes, services, anonymous_agent,
tests). Re-export shims remain for the frozen single-agent stack: a package
__init__ mirroring the public surface (new_chat.__init__ imports it) plus
invalid_tool + registry submodule shims (chat_deepagent imports those).

Resolves slice 5c's two transient back-edges: shared/middleware/action_log
(TYPE_CHECKING ToolDefinition) and tool_call_repair (local INVALID_TOOL_NAME)
now point at app.agents.shared.tools.

surfsense_backend/tests/unit/services/test_image_gen_api_base_defense.py

@@ -90,7 +90,7 @@ async def test_global_openrouter_image_gen_sets_api_base_when_config_empty():
 async def test_generate_image_tool_global_sets_api_base_when_config_empty():
     """Same defense at the agent tool entry point — both surfaces share
     the same OpenRouter config payloads."""
-    from app.agents.new_chat.tools import generate_image as gi_module
+    from app.agents.shared.tools import generate_image as gi_module
 
     cfg = {
         "id": -20_001,