feat(agent): Go port — canvas engine, 22 components, DSL v2, 13 endpoints (#15952)

Ports the agent canvas subsystem from Python to Go.

## What's included

### Canvas Engine (Phase 0/1)
- State engine, scheduler, variable resolver, Redis checkpoint store,
cancel protocol
- **209 tests** across canvas / component / io packages

### 22 Components (P0–P4)
| Tier | Components |
|---|---|
| P0 T1+T2+T3 | LLM, Agent, ExitLoop, Switch, Categorize, Begin,
Message, Invoke |
| P1 T3 | VariableAggregator, VariableAssigner, StringTransform,
ListOperations, DataOperations |
| P2 T3 | Iteration, IterationItem, Loop, LoopItem |
| P3 T3 | UserFillUp, Fillup |
| P4 T5 | Browser, ExcelProcessor, DocsGenerator |

### DSL v2 Schema (Phase 2.5)
- Typed v2 in-memory model with v1-to-v2 auto-detect converter
- v1 legacy field stripping per plan §2.11.7

### HTTP Endpoints & Bug Fixes (Plans PR1–PR3)
- **DELETE SQL bug fix**: gorm v2 `Where("id = ?", id).Delete(...)`
pattern
- **CreateAgent validation**: title/DSL required, duplicate check, 103
envelope
- **13 new endpoints**: templates, prompts, tags, sessions CRUD,
chat/completions (SSE + non-stream stubs), rerun, test_db_connection,
logs, webhook/logs
- **756 Go unit tests** (745 → 756, +18)
- **17 → 0 Python integration test failures** (test_agents.py +
test_session_management/)

### Tools
21 eino tools: HTTPHelper, search tools, financial/data tools, mandatory
stubs

### Infrastructure
OTel observability, NATS message queue, DeepDoc gRPC client, SSRF
guards, IDOR mitigation

internal/entity/models/base_model.go

@@ -87,6 +87,9 @@ func (b *BaseModel) GetBaseURL(apiConfig *APIConfig) (string, error) {
 
 // ParseSSEStream reads the body of an OpenAI-compatible Server-Sent Events
 // response and calls onEvent for each successfully-parsed JSON payload.
+// A malformed JSON payload after "data:" returns an error wrapped as
+// "invalid SSE event" so the caller cannot silently swallow truncated or
+// corrupted streams.
 func ParseSSEStream[T any](r io.Reader, onEvent func(event T) error) (done bool, err error) {
 	scanner := bufio.NewScanner(r)
 	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
@@ -96,6 +99,39 @@ func ParseSSEStream[T any](r io.Reader, onEvent func(event T) error) (done bool,
 			continue
 		}
 		data := strings.TrimSpace(line[5:])
+		if data == "" {
+			continue
+		}
+		if data == "[DONE]" {
+			return true, nil
+		}
+		var event T
+		if err := json.Unmarshal([]byte(data), &event); err != nil {
+			return false, fmt.Errorf("invalid SSE event: %w", err)
+		}
+		if err := onEvent(event); err != nil {
+			return false, err
+		}
+	}
+	return false, scanner.Err()
+}
+
+// ParseSSEStreamTolerant is like ParseSSEStream but silently skips
+// malformed JSON payloads. Use this only for drivers whose upstream is
+// known to interleave invalid frames the test suite documents as safe
+// to ignore.
+func ParseSSEStreamTolerant[T any](r io.Reader, onEvent func(event T) error) (done bool, err error) {
+	scanner := bufio.NewScanner(r)
+	scanner.Buffer(make([]byte, 64*1024), 1024*1024)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !strings.HasPrefix(line, "data:") {
+			continue
+		}
+		data := strings.TrimSpace(line[5:])
+		if data == "" {
+			continue
+		}
 		if data == "[DONE]" {
 			return true, nil
 		}
@@ -110,19 +146,23 @@ func ParseSSEStream[T any](r io.Reader, onEvent func(event T) error) (done bool,
 	return false, scanner.Err()
 }
 
-// ParseListModel Parse model list
+// ParseListModel Parse model list. Empty/whitespace IDs are skipped so
+// upstream typos do not surface as blank entries in the UI.
 func ParseListModel(modelList ModelList) []ListModelResponse {
 	var models []ListModelResponse
 	pm := GetProviderManager()
 	for _, model := range modelList.Models {
-		modelName := model.ID
+		modelName := strings.TrimSpace(model.ID)
+		if modelName == "" {
+			continue
+		}
 		var modelResponse ListModelResponse
 		var modelEntity *Model
 		if pm != nil {
 			modelEntity = pm.GetModelByNameOrAlias(modelName)
 		}
 		if model.OwnedBy != "" {
-			modelName = model.ID + "@" + model.OwnedBy
+			modelName = modelName + "@" + model.OwnedBy
 		}
 		modelResponse.Name = modelName
 		if modelEntity != nil {