feat: spawn_agent tool + host max_concurrent + docs

Adds a synchronous sub-agent spawning tool that lets the orchestrator
delegate tasks to a specific role's model and tool set.

- cortex/tools/agents.py: spawn_agent(task, role, tier, timeout, max_rounds)
  - Supports local_openai and gemini_api model types
  - Per-host asyncio semaphore (keyed by host_id or model type)
  - asyncio.wait_for() enforces timeout; admin-only tool
- cortex/model_registry.py: max_concurrent field in host schema (default 3,
  clamped 1-20); backfilled on _normalize() for existing hosts
- cortex/routers/local_llm.py + local_llm.html: "Max parallel" number input
  in host add/edit forms
- cortex/tools/__init__.py: spawn_agent registered in TOOL_CATEGORIES["Agents"],
  _CALLABLES, TOOL_ROLES (admin), and _ALL_DECLARATIONS
- Docs: TOOLS.md count 44→45, spawn_agent section; HELP.md tool table updated;
  ARCH__FUTURE.md Round 2 completed items; TODO__Agents.md spawn_agent checked;
  CLAUDE.md tool count and list updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -81,6 +81,12 @@ system prompt by `context_loader.py` at all tiers.
   - `context_loader.py` calls `load_due_reminders()` — future-dated sections suppressed until due
   - `reminders_list` shows `[OVERDUE]`, `[due TODAY]`, or `[due: YYYY-MM-DD]` per entry
   - Backward compatible — existing undated reminders always surface as before
+- [x] **`spawn_agent`** — spawn a synchronous sub-agent using any role's model + tools — 2026-05-08
+  - `cortex/tools/agents.py` — `spawn_agent(task, role, tier, timeout, max_rounds)`
+  - Per-host asyncio semaphore keyed by `host_id` (or model type for cloud); `max_concurrent` field in host schema
+  - Supports `local_openai` and `gemini_api` model types; returns error string for others
+  - Admin-only tool (powerful — can spawn arbitrarily long sub-tasks)
+  - Host UI: "Max parallel" number input in host edit/add forms
 - [ ] **`http_post`** — POST to external URLs
   - Params: `url: str`, `body: dict | str`, `headers: dict | None`
   - Per-user host allowlist in `home/{user}/http_allowlist.json` (same pattern as email)