feat: add agent API and operational analytics

docs/configuration.md

@@ -42,7 +42,7 @@ Configuration is loaded at startup by `loadConfig()` in `src/config/index.ts`, w
 3. Validates the entire configuration tree using Zod
 4. Returns a strongly-typed `Config` object
 
-Application-owned settings are edited from the dashboard and saved to SQLite. `OPENROUTER_API_KEY`, `WEB_DASHBOARD_TOKEN`, and `DATABASE_PATH` remain environment-owned bootstrap values and are never stored in `app_config`.
+Application-owned settings are edited from the dashboard and saved to SQLite. `OPENROUTER_API_KEY`, `WEB_DASHBOARD_TOKEN`, `REDDIT_BOT_AGENT_READ_TOKEN`, `REDDIT_BOT_AGENT_CONTROL_TOKEN`, and `DATABASE_PATH` remain environment-owned bootstrap values and are never stored in `app_config`.
 
 ---
 
@@ -87,6 +87,10 @@ Environment variables provide secrets and bootstrap settings that are intentiona
 |---|---|---|---|---|
 | `OPENROUTER_API_KEY` | Yes | string | OpenRouter API key for AI services | `sk-or-v1-abc123...` |
 | `WEB_DASHBOARD_TOKEN` | Yes when dashboard enabled | string | Dashboard access token | `long-random-secret` |
+| `REDDIT_BOT_AGENT_READ_TOKEN` | No | string | Least-privilege GET/SSE agent access | `separate-read-secret` |
+| `REDDIT_BOT_AGENT_CONTROL_TOKEN` | No | string | Read access plus `/api/v1` controls/jobs | `separate-control-secret` |
+| `REDDIT_BOT_API_URL` | MCP only | URL | HTTP base URL used by `npm run mcp` | `http://127.0.0.1:3000` |
+| `REDDIT_BOT_AGENT_TOKEN` | MCP only | string | Token selected for the MCP process | `separate-read-secret` |
 | `DATABASE_PATH` | No | string | SQLite database location | `./data/reddit-bot.db` |
 
 ### Setting Environment Variables
@@ -98,6 +102,8 @@ Create a `.env` file in the project root:
 ```env
 OPENROUTER_API_KEY=sk-or-v1-abc123...
 WEB_DASHBOARD_TOKEN=long-random-secret
+REDDIT_BOT_AGENT_READ_TOKEN=separate-read-secret
+REDDIT_BOT_AGENT_CONTROL_TOKEN=separate-control-secret
 ```
 
 > **Note**: Add `.env` to `.gitignore` - never commit credentials.
@@ -107,6 +113,8 @@ WEB_DASHBOARD_TOKEN=long-random-secret
 ```bash
 export OPENROUTER_API_KEY=sk-or-v1-abc123...
 export WEB_DASHBOARD_TOKEN=long-random-secret
+export REDDIT_BOT_AGENT_READ_TOKEN=separate-read-secret
+export REDDIT_BOT_AGENT_CONTROL_TOKEN=separate-control-secret
 ```
 
 **Option 3: Docker**
@@ -117,6 +125,8 @@ Pass via `docker-compose.yml` or Docker CLI:
 environment:
   - OPENROUTER_API_KEY=sk-or-v1-abc123...
   - WEB_DASHBOARD_TOKEN=long-random-secret
+  - REDDIT_BOT_AGENT_READ_TOKEN=separate-read-secret
+  - REDDIT_BOT_AGENT_CONTROL_TOKEN=separate-control-secret
 ```
 
 ---

docs/deployment.md

@@ -91,6 +91,8 @@ Set environment variables:
 ```bash
 export OPENROUTER_API_KEY="sk-or-v1-your-key"
 export WEB_DASHBOARD_TOKEN="long-random-secret"
+export REDDIT_BOT_AGENT_READ_TOKEN="separate-read-secret"
+export REDDIT_BOT_AGENT_CONTROL_TOKEN="separate-control-secret"
 ```
 
 ### 3. Import account session
@@ -135,6 +137,8 @@ docker run -d \
   -v $(pwd)/data:/app/data \
   -e OPENROUTER_API_KEY=sk-or-v1-your-key \
   -e WEB_DASHBOARD_TOKEN=long-random-secret \
+  -e REDDIT_BOT_AGENT_READ_TOKEN=separate-read-secret \
+  -e REDDIT_BOT_AGENT_CONTROL_TOKEN=separate-control-secret \
   reddit-bot:latest
 ```
 
@@ -169,9 +173,11 @@ services:
     environment:
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
       - WEB_DASHBOARD_TOKEN=${WEB_DASHBOARD_TOKEN}
+      - REDDIT_BOT_AGENT_READ_TOKEN=${REDDIT_BOT_AGENT_READ_TOKEN:-}
+      - REDDIT_BOT_AGENT_CONTROL_TOKEN=${REDDIT_BOT_AGENT_CONTROL_TOKEN:-}
     restart: unless-stopped
     healthcheck:
-      test: ["CMD", "wget", "--spider", "http://localhost:3000/api/stats"]
+      test: ["CMD", "wget", "--spider", "http://localhost:3000/healthz"]
       interval: 30s
       timeout: 10s
       retries: 3