feat(desktop): wire template welcome_message + quick_commands to chat UI

- Add welcomeMessage/quickCommands fields to Clone interface
- Persist template welcome/quick data via updateClone after creation
- FirstConversationPrompt: prefer template-provided welcome message
  over dynamically generated one
- FirstConversationPrompt: render template quick_commands as chips
  instead of hardcoded QUICK_ACTIONS when available
- Tighten assign/unassign template endpoint permissions from model:read
  to relay:use (self-service operation for all authenticated users)

crates/zclaw-saas/src/agent_template/handlers.rs

@@ -148,7 +148,7 @@ pub async fn assign_template(
     Extension(ctx): Extension<AuthContext>,
     Json(req): Json<AssignTemplateRequest>,
 ) -> SaasResult<Json<AgentTemplateInfo>> {
-    check_permission(&ctx, "model:read")?;
+    check_permission(&ctx, "relay:use")?;
 
     let result = service::assign_template_to_account(
         &state.db, &ctx.account_id, &req.template_id,
@@ -174,7 +174,7 @@ pub async fn unassign_template(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
 ) -> SaasResult<Json<serde_json::Value>> {
-    check_permission(&ctx, "model:read")?;
+    check_permission(&ctx, "relay:use")?;
     service::unassign_template(&state.db, &ctx.account_id).await?;
     Ok(Json(serde_json::json!({"ok": true})))
 }