🧹 chore: Optimize provisioning — single credential load, deferred DB writes

- loadCodeApiKey: load CODE_API_KEY once per request, pass to both
  checkSessionsAlive and provisionToCodeEnv (was N+1 lookups)
- provisionToCodeEnv/provisionToVectorDB now return fileUpdate objects
  instead of writing to DB immediately
- primeResources batches all DB updates via Promise.allSettled after
  provisioning completes
- Remove updateFile import from provision.js (no longer writes directly)

api/server/services/Endpoints/agents/initialize.js

@@ -24,6 +24,7 @@ const {
 const { loadAgentTools, loadToolsForExecution } = require('~/server/services/ToolService');
 const { filterFilesByAgentAccess } = require('~/server/services/Files/permissions');
 const {
+  loadCodeApiKey,
   provisionToCodeEnv,
   provisionToVectorDB,
   checkSessionsAlive,
@@ -224,6 +225,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
       provisionToCodeEnv,
       provisionToVectorDB,
       checkSessionsAlive,
+      loadCodeApiKey,
+      updateFile: db.updateFile,
     },
   );
 
@@ -308,6 +311,8 @@ const initializeClient = async ({ req, res, signal, endpointOption }) => {
         provisionToCodeEnv,
         provisionToVectorDB,
         checkSessionsAlive,
+        loadCodeApiKey,
+        updateFile: db.updateFile,
       },
     );