feat: add agent API and operational analytics

tests/web-auth.test.ts

@@ -48,6 +48,28 @@ describe('dashboard authentication', () => {
     expect(await response.json()).toEqual({ ok: true });
   });
 
+  it('limits agent bearer tokens to their declared access', async () => {
+    const app = express();
+    app.use(express.json());
+    app.use(createDashboardAuth('dashboard-secret', {
+      readToken: 'agent-read-secret',
+      controlToken: 'agent-control-secret',
+    }));
+    app.get('/api/v1/overview', (_req, res) => res.json({ ok: true }));
+    app.post('/api/v1/control/start', (_req, res) => res.json({ ok: true }));
+    app.post('/api/conversations/start', (_req, res) => res.json({ ok: true }));
+
+    const read = await request(app, '/api/v1/overview', { headers: { Authorization: 'Bearer agent-read-secret' } });
+    const readMutation = await request(app, '/api/v1/control/start', { method: 'POST', headers: { Authorization: 'Bearer agent-read-secret' } });
+    const control = await request(app, '/api/v1/control/start', { method: 'POST', headers: { Authorization: 'Bearer agent-control-secret' } });
+    const legacyMutation = await request(app, '/api/conversations/start', { method: 'POST', headers: { Authorization: 'Bearer agent-control-secret' } });
+
+    expect(read.status).toBe(200);
+    expect(readMutation.status).toBe(403);
+    expect(control.status).toBe(200);
+    expect(legacyMutation.status).toBe(403);
+  });
+
   it('issues an HttpOnly session only for a schema-valid token payload', async () => {
     const app = express();
     app.use(express.json());