refactor(backend): move per-provider provisioning onto AgentProvider

BottleBackend.provision now resolves the provider plugin from the
plan and dispatches prompt / skills / declarative-apply /
supervise-mcp through it. The four hooks the docker + smolmachines
backends used to override (provision_skills, provision_prompt,
provision_provider_auth, provision_supervise) are gone — the
duplicated 50-line implementations under
backend/{docker,smolmachines}/provision/{skills,prompt,
provider_auth,supervise}.py are deleted.

Each backend gains a small supervise_mcp_url(plan) override so the
provider plugin can run `claude mcp add` / `codex mcp add`
against the right URL: docker returns
http://{SUPERVISE_HOSTNAME}:{SUPERVISE_PORT}/ on the compose
network alias; smolmachines returns plan.agent_supervise_url which
launch.py already pins to a host-loopback port.

Removes tests/unit/test_provision_supervise.py — the URL it
asserted on now lives on the backend, with no equivalent
standalone surface to test against (it's covered by the broader
plan / launch integration tests).

tests/unit/test_provision_supervise.py

@@ -1,30 +0,0 @@
-"""Unit: supervise MCP provisioning (PRD 0013 follow-up).
-
-The real provisioning runs `claude mcp add` inside the agent
-container — exercised by the existing supervise integration test
-chain once the agent container is brought up. Here we just cover
-the URL computation so a regression in SUPERVISE_HOSTNAME / PORT
-plumbing surfaces in unit CI."""
-
-import unittest
-
-from bot_bottle.backend.docker.provision.supervise import supervise_mcp_url
-from bot_bottle.supervise import SUPERVISE_HOSTNAME, SUPERVISE_PORT
-
-
-class TestSuperviseMcpUrl(unittest.TestCase):
-    def test_url_matches_sidecar_constants(self):
-        self.assertEqual(
-            f"http://{SUPERVISE_HOSTNAME}:{SUPERVISE_PORT}/",
-            supervise_mcp_url(),
-        )
-
-    def test_url_is_http_not_https(self):
-        # The agent dials the sidecar on the internal docker network;
-        # no TLS termination, no CA trust juggling. If this ever
-        # needs HTTPS, the sidecar's listener side has to change too.
-        self.assertTrue(supervise_mcp_url().startswith("http://"))
-
-
-if __name__ == "__main__":
-    unittest.main()