feat(llm): approval-gated movement executor + rag-api agent wiring + agent UI

- decide_approval now executes the underlying data movement when an approved
  request carries an executor=movement payload (real human-gated executor).
- rag-api service gets OPENMETADATA_* (via atc.env) + COMMAND_CENTER_URL so it can
  sync the catalog and call platform tools.
- Knowledge Chat gains an Agent-mode toggle (SSE tool-loop with step chips) and a
  'Sync catalog' button.

docker-compose.yml

@@ -87,6 +87,8 @@ services:
   rag-api:
     build: ../atc-data-quality/rag-api
     restart: unless-stopped
+    env_file:
+      - atc.env
     environment:
       CHROMA_HOST: chromadb
       CHROMA_PORT: 8000
@@ -95,11 +97,14 @@ services:
       LLM_MODEL: gpt-4o
       LLM_API_KEY: sk-local
       RAG_DATA_DIR: /data
+      OPENMETADATA_URL: ${OPENMETADATA_URL:-http://10.0.21.47:8585}
+      COMMAND_CENTER_URL: http://api:3201
     volumes:
       - rag_data:/data
     depends_on:
       - chromadb
       - docling-serve
+      - api
 
   dq-api:
     build: ../atc-data-quality/dq-api