feat(agent): Go port — canvas engine, 22 components, DSL v2, 13 endpoints (#15952)

Ports the agent canvas subsystem from Python to Go.

## What's included

### Canvas Engine (Phase 0/1)
- State engine, scheduler, variable resolver, Redis checkpoint store,
cancel protocol
- **209 tests** across canvas / component / io packages

### 22 Components (P0–P4)
| Tier | Components |
|---|---|
| P0 T1+T2+T3 | LLM, Agent, ExitLoop, Switch, Categorize, Begin,
Message, Invoke |
| P1 T3 | VariableAggregator, VariableAssigner, StringTransform,
ListOperations, DataOperations |
| P2 T3 | Iteration, IterationItem, Loop, LoopItem |
| P3 T3 | UserFillUp, Fillup |
| P4 T5 | Browser, ExcelProcessor, DocsGenerator |

### DSL v2 Schema (Phase 2.5)
- Typed v2 in-memory model with v1-to-v2 auto-detect converter
- v1 legacy field stripping per plan §2.11.7

### HTTP Endpoints & Bug Fixes (Plans PR1–PR3)
- **DELETE SQL bug fix**: gorm v2 `Where("id = ?", id).Delete(...)`
pattern
- **CreateAgent validation**: title/DSL required, duplicate check, 103
envelope
- **13 new endpoints**: templates, prompts, tags, sessions CRUD,
chat/completions (SSE + non-stream stubs), rerun, test_db_connection,
logs, webhook/logs
- **756 Go unit tests** (745 → 756, +18)
- **17 → 0 Python integration test failures** (test_agents.py +
test_session_management/)

### Tools
21 eino tools: HTTPHelper, search tools, financial/data tools, mandatory
stubs

### Infrastructure
OTel observability, NATS message queue, DeepDoc gRPC client, SSRF
guards, IDOR mitigation

internal/agent/component/begin_test.go

@@ -0,0 +1,88 @@
+//
+//  Copyright 2026 The InfiniFlow Authors. All Rights Reserved.
+//
+//  Licensed under the Apache License, Version 2.0 (the "License");
+//  you may not use this file except in compliance with the License.
+//  You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+//  Unless required by applicable law or agreed to in writing, software
+//  distributed under the License is distributed on an "AS IS" BASIS,
+//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//  See the License for the specific language governing permissions and
+//  limitations under the License.
+//
+
+package component
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"ragflow/internal/agent/canvas"
+)
+
+// TestBegin_InjectsSys verifies the canonical happy path: a query flows
+// through Invoke and lands in state.Sys["query"]. user_id is optional
+// and absent in this test (omitted from inputs entirely).
+func TestBegin_InjectsSys(t *testing.T) {
+	c, err := NewBeginComponent(nil)
+	if err != nil {
+		t.Fatalf("NewBeginComponent: %v", err)
+	}
+	state := canvas.NewCanvasState("run-1", "task-1")
+	ctx := canvas.WithState(context.Background(), state)
+
+	out, err := c.Invoke(ctx, map[string]any{"query": "hello"})
+	if err != nil {
+		t.Fatalf("Invoke: %v", err)
+	}
+	if got, _ := state.Sys["query"].(string); got != "hello" {
+		t.Errorf("state.Sys[query]: got %q, want %q", got, "hello")
+	}
+	// user_id absent in inputs → must not be present in state.Sys
+	if _, ok := state.Sys["user_id"]; ok {
+		t.Errorf("state.Sys[user_id] should not be set when inputs lack it; got %v", state.Sys["user_id"])
+	}
+	// Output passthrough
+	if out["query"] != "hello" {
+		t.Errorf("outputs[query]: got %v, want %q", out["query"], "hello")
+	}
+}
+
+// TestBegin_PassesThroughInputs asserts the full inputs map — including
+// arbitrary keys beyond query / user_id — is returned unchanged as
+// outputs. This is the contract downstream components rely on to access
+// DSL-level inputs the engine has not explicitly modeled.
+func TestBegin_PassesThroughInputs(t *testing.T) {
+	c, _ := NewBeginComponent(nil)
+	state := canvas.NewCanvasState("run-2", "task-2")
+	ctx := canvas.WithState(context.Background(), state)
+
+	inputs := map[string]any{
+		"query":   "what is ragflow",
+		"user_id": "tenant-7",
+		"inputs":  map[string]any{"k": "v"},
+		"extra":   42,
+	}
+	out, err := c.Invoke(ctx, inputs)
+	if err != nil {
+		t.Fatalf("Invoke: %v", err)
+	}
+	if !reflect.DeepEqual(out, inputs) {
+		t.Errorf("output passthrough failed:\n got  %v\n want %v", out, inputs)
+	}
+	if got, _ := state.Sys["user_id"].(string); got != "tenant-7" {
+		t.Errorf("state.Sys[user_id]: got %q, want %q", got, "tenant-7")
+	}
+}
+
+// withStateForTest is a thin alias for canvas.WithState kept for
+// readability at the test call sites. Declared once in this file; the
+// other test files in this package (message_test.go, switch_test.go)
+// reference the same symbol because Go test files share a package.
+func withStateForTest(ctx context.Context, s *canvas.CanvasState) context.Context {
+	return canvas.WithState(ctx, s)
+}