feat(agent-service): add opt-in access control and per-user isolation

[bobbai00]

What changes were proposed in this PR?

The agent service had no real access control: any caller who supplied an agent id could read or drive any agent, ids were sequential (agent-${counter}), GET /agents returned everyone's agents, and user tokens were only base64-decoded — never signature-verified.

This PR introduces access control, opt-in via AGENT_AUTH_REQUIRED (default false) so existing deployments are unchanged until it is switched on.

Backend (agent-service):

• auth-api.ts: real HS256 signature verification against AUTH_JWT_SECRET, matching the backend JwtAuth (requires sub + exp, 30s clock skew, constant-time compare). Adds verifyToken, getUidFromToken, isAuthRequired.
• server.ts: each agent is bound to its owner's uid at creation; a single onBeforeHandle guard authorizes every /:id route, the WebSocket handshake is authorized in open, and GET /agents is scoped to the caller. Agent ids are now random UUIDs. When enforcement is on, creation requires a valid token. Missing/invalid token → 401; wrong owner → 403.

Frontend: agent.service.ts now sends the user token on every agent request (Authorization: Bearer …) and on the WebSocket via the access-token query parameter (browsers can't set WS headers), mirroring the existing workflow-websocket.service.ts idiom. These are inert while enforcement is off.

Before: any caller + agent id -> full read/control of any agent
After: AGENT_AUTH_REQUIRED -> verified token, owner-scoped access, UUID ids

Any related issues, documentation, discussions?

Closes #5268

How was this PR tested?

Agent service (unit tests, type, format):

cd agent-service
bun test            # 116 pass, 0 fail (incl. auth-api.test.ts and the new
                    #   "access control (AGENT_AUTH_REQUIRED)" suite in server.test.ts)
bun run typecheck   # clean
bun run format:check

The new tests cover signature verification (valid / wrong-secret / expired / missing-sub / non-HS256), permissive vs enforced validateToken, UUID id format + uniqueness, owner-can-read, non-owner→403, missing-token→401, guarded control route, and scoped listing.

Frontend: eslint and prettier --check pass on the changed file. The change is small and mirrors an existing idiom; the full Angular build was not run locally, and the change is inert unless AGENT_AUTH_REQUIRED is enabled.

Was this PR authored or co-authored using generative AI tooling?

Generated-by: Claude Opus 4.8 (1M context)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 85.21127% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.25%. Comparing base (7bd6550) to head (15243a0).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
agent-service/src/server.ts	82.43%	13 Missing ⚠️
...d/src/app/workspace/service/agent/agent.service.ts	0.00%	7 Missing ⚠️
agent-service/src/api/auth-api.ts	98.36%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #5275      +/-   ##
============================================
+ Coverage     49.01%   49.25%   +0.23%     
  Complexity     2378     2378              
============================================
  Files          1050     1051       +1     
  Lines         40336    40465     +129     
  Branches       4277     4279       +2     
============================================
+ Hits          19772    19932     +160     
+ Misses        19407    19377      -30     
+ Partials       1157     1156       -1     

Flag	Coverage Δ		*Carryforward flag
access-control-service	39.53% <ø> (ø)		Carriedforward from 7bd6550
agent-service	36.08% <89.62%> (+2.31%)	⬆️
amber	51.58% <ø> (ø)		Carriedforward from 7bd6550
computing-unit-managing-service	0.00% <ø> (ø)		Carriedforward from 7bd6550
config-service	0.00% <ø> (ø)		Carriedforward from 7bd6550
file-service	37.99% <ø> (ø)		Carriedforward from 7bd6550
frontend	41.05% <0.00%> (+0.22%)	⬆️
python	90.79% <ø> (ø)		Carriedforward from 7bd6550
workflow-compiling-service	56.81% <ø> (ø)		Carriedforward from 7bd6550

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.