Motivation

• Provide an admin-only flow to publish public agent card artifacts for claims that have been approved, enabling verified agent discovery without exposing admin actions to the public.
• Keep this rollout narrowly focused: do not add Stripe, ERC-8004 registration, ENS provisioning, fake ENS writes, or alter claim validation or admin auth behavior.

Description

• Add DB migration db/migrations/003_agent_cards.sql to extend claim_agents with card_url, card_status, card_published_at and to create a new agent_cards table with indexes for claim_id, ens, and card_url.
• Add admin endpoint POST /api/admin/publish-agent-cards (api/admin/publish-agent-cards.js) that requires ADMIN_API_KEY, enforces claim approved status, is idempotent (returns existing cards if already published), inserts/updates agent_cards, updates claim_agents.card_url/card_status/card_published_at, updates claim_requests.status to cards_published, and inserts claim_events and claim_status_transitions entries.
• Add public card-serving route GET /api/agent-cards/card (api/agent-cards/card.js) that looks up published cards by ens or path and returns card_json as application/json, returning 404 when not found.
• Update admin UI public/admin/claims.html to show a Publish agent cards button when status is approved, and to show published card URLs plus Copy all card URLs / Open first card / payment placeholder when status is cards_published.
• Add unit tests tests/api-admin-publish-agent-cards.test.js covering missing ADMIN_API_KEY, unauthorized requests, non-approved claims, successful publish behavior, idempotency, public card route JSON response, and missing-card 404.

Testing

• Ran npm test; test suite completed successfully with all tests passing (including new publish and public route tests).
• Ran cd examples/webhook-auto-verify && npm install and npm run check; both succeeded.
• Top-level npm install in this environment failed due to registry policy (403 Forbidden fetching @neondatabase/serverless), but tests are structured to mock DB calls and passed locally in CI-style test runs.

Codex Task