Inbound HTTP ingestion for apps

Apps can now receive data pushed in from external services, scripts, or AI agents over HTTP. Tenant settings gained an Inbound API card to enable, rotate, and disable bearer tokens with a one-time reveal. Apps read incoming items via a new app.ingest SDK (list, get, subscribe, delete, plus a sandboxed HTML renderer), Studio's diagnostics panel has an Ingest tab for inspecting the dev stream, and there's a reference "inbox" example to crib from.