feat(dashboards): shared agent dashboard service and conditional editing

[VibeSWE]

Adds the prerequisite dashboard feature needed to review the concurrent idempotent-create fix separately. REST, the native frontend, and dashboard tools share authoritative document reads and conditional mutations; configuration validation/dry runs stay separate from explicit bounded SQL/builder/PromQL execution. External dashboard writes require P_DASHBOARD_AGENT_WRITES=true and per-operation RBAC, tenant, and owner/admin checks.

This is a sizeable DRAFT, extracted as a reviewed 40-file dashboard allowlist from the development workspace: 13,200 additions / 638 deletions. It includes ID-addressed patching, opaque revisions/ETags, durable retry receipts, title reservations/locators/tombstones, local/cloud conditional-storage adapters, frontend conflicts/deletes/refresh defaults, documentation, and a disposable agent smoke script. No Kafka/event/OTel/staging/query-performance/response/Arrow/JSON performance changes are included; existing query interfaces and Cargo dependencies suffice.

Compatibility merge blockers — this draft is not API-compatible:

• Dashboard listing changes from modified-descending order to dashboard-ID order; positive REST limits are capped at 500; empty tags no longer produces the former error.
• Dashboard errors change from plaintext to JSON, and unauthorized dashboard errors change from HTTP 401 to 403.
• Full PUT replacement now requires an observed header/body revision and returns 428 when missing, breaking older unconditional clients. Existing public declaration names remain, but internal list/tag helpers also change return signatures.
• Resolve these against the public-API-preservation requirement before merge; this extraction intentionally does not redesign compatibility.

Additional premerge review findings: corrupt dashboard JSON now fails the whole tenant list/tag operation instead of being skipped/logged; tombstones/internal metadata risk deleted-dashboard resurrection with mixed versions or rollback; unsupported conditional PUT stores return 501 with no unsafe fallback; authoritative reads perform full per-request object listing/fetches and need resource-cost review. Tool discovery is now visible to any authenticated role, including suspended roles (this exposes catalog metadata, not dataset content). Semaphore tests use shared globals and may interfere under parallel suite execution. Independent review found no blocker to publishing this coherent draft and no dependency on excluded performance code; these findings remain open.

Review still required: full public API contract review; authentication-only multiplexed tool transport and per-operation authorization/security review; tenant/owner/admin checks; storage-CAS failure/recovery and upgrade/rollback behavior; live S3/GCS/Azure behavior. All writers must participate in the new protocol. This feature is not fully validated.

Fresh checks on this branch:

• /home/ajs/.cargo/bin/rustfmt --check --edition 2024 --config skip_children=true on all 20 selected Rust files: passed.
• frontend/node_modules/.bin/tsc --noEmit: passed.
• Prettier --check on all 18 selected frontend files: passed.
• Vitest (--maxWorkers=2 --no-cache --configLoader runner) for helpers.test.ts, importExport.test.ts, DashboardRefresh.test.tsx, dashboardsClient.test.ts, and dashboardsContract.test.ts: 62 passed / 5 files using already-installed dependencies.
• Python AST parse of scripts/test-dashboard-agent.py and git diff --check: passed. The smoke script was not executed.

Rust compilation/tests, browser E2E, native-server smoke, and current CI remain pending. Historical development-workspace results carried in the documentation and reconstructed-overlay R81 evidence (835 passed / 1 ignored, including the four race subcases with the later patch) are not fresh tests of this branch.

src/users/dashboard_service.rs remains the original baseline, SHA-256 ef366d16c2e8d178b16cbf80a504708e70304feb253adefcb76c89e0bed3a38b; the known create race is intentionally left for the next stacked draft. Base: main at 9747e2ba7a6dc18e2965b24fc84dd0632dadd87e. No merge/deployment performed.