refactor: bind container lifecycle to bot and improve schedule trigger flow

- Add SetupBotContainer to ContainerLifecycle interface so containers
  are automatically created when a bot is created, matching the existing
  cleanup-on-delete behavior.
- Refactor schedule tools to use bot-scoped API paths and pass identity
  context for proper authorization.
- Introduce dedicated trigger-schedule endpoint in chat resolver with
  explicit schedule payload instead of reusing the generic chat path.
- Generate short-lived JWT tokens for schedule trigger callbacks with
  resolved bot owner identity.
- Validate required parameters in NewLLMClient and NewOpenAIEmbedder
  constructors, returning errors instead of falling back to defaults.
- Add unit tests for schedule token generation and chat resolver.

internal/bots/service.go

@@ -112,7 +112,19 @@ func (s *Service) Create(ctx context.Context, ownerUserID string, req CreateBotR
 	if err != nil {
 		return Bot{}, err
 	}
-	return toBot(row)
+	bot, err := toBot(row)
+	if err != nil {
+		return Bot{}, err
+	}
+	if s.containerLifecycle != nil {
+		if err := s.containerLifecycle.SetupBotContainer(ctx, bot.ID); err != nil {
+			s.logger.Error("failed to setup bot container",
+				slog.String("bot_id", bot.ID),
+				slog.Any("error", err),
+			)
+		}
+	}
+	return bot, nil
 }
 
 func (s *Service) Get(ctx context.Context, botID string) (Bot, error) {

internal/bots/types.go

@@ -58,6 +58,7 @@ type ListMembersResponse struct {
 
 // ContainerLifecycle handles container lifecycle events bound to bot operations.
 type ContainerLifecycle interface {
+	SetupBotContainer(ctx context.Context, botID string) error
 	CleanupBotContainer(ctx context.Context, botID string) error
 }