AgentCommand model + migration:
- nawasara_agent_commands table with full lifecycle (pending/approved/rejected/sent/completed/failed)
- sudo gate on approve() via RequiresSudo attribute

API endpoints:
- GET /api/agent/commands/pending — returns approved commands, marks as sent
- POST /api/agent/command-result — receives execution result from agent

Livewire UI (Section/Commands.php + commands.blade.php):
- Issue command modal with action selector + IP param for block/unblock
- Approval queue table with Approve (sudo-gated) / Reject buttons
- Reject reason modal
- Output viewer modal per command

Permission: secscan.agent.command added to PermissionSeeder
require: nawasara/auth-primitives added to composer.json