Fix agent dashboard auth path in Convex

[codybmenefee]

Summary

• wire Convex to Clerk auth using ConvexProviderWithClerk so ctx.auth.getUserIdentity() is populated server-side
• fix agent farm access guards to accept Clerk org claim (org_id) as a fallback when user farm fields are stale
• backfill blank users.farmExternalId / users.activeFarmExternalId on existing records during createUser and setActiveFarm

Why
Users with valid billing entitlements were still blocked by server-side agentAdmin:getDashboardState because backend identity/farm access checks were relying on stale or missing mirrors.

Validation

• cd app && npx eslint src/main.tsx convex/lib/agentAccess.ts convex/agentAdmin.ts convex/users.ts
• cd app && pnpm run build