Require durable Rich Threads for live deployments

[jerelvelarde]

What changed

• Require a server-only CPK_INTELLIGENCE_API_KEY before a live OpenMuse API initializes.
• Keep sample mode and separate task/browser/computer workers key-free.
• Add the official CopilotKit login and project-selection path to the startup error and deployment docs.

This is a breaking configuration change for WORKSPACE_MODE=live. Existing live deployments must create or select an Intelligence project, set the generated key on the API service, and restart. Local sample workflows are unchanged.

Verification

• pnpm exec biome format .
• pnpm lint
• pnpm typecheck
• pnpm --dir apps/worker typecheck
• pnpm test (157 passed)
• pnpm build:server

Integration limits

Startup validates that the key is present without making a remote request or assuming a hosted/self-hosted key format. A revoked, mistyped, or wrong-project credential remains an Intelligence SDK error on first use. Live platform acceptance requires a real project key.