feat(api): admin agent config read and save (13/15)

[ccf-lisa]

Part 13/15 of the agent remote-configuration stack

This stack splits #465 into reviewable layers of at most ~1000 changed lines each (counted without docs/, go.sum and Markdown). The last layer's tree is identical to #465, which already has its review history.

Stacked on #480 (lisa/agent-config/12-agent-config-report). Review and merge in order.

What's in this layer

Thirteenth layer of the agent remote-configuration stack (split from #465): GET /api/admin/agents/{id}/config returns the current overlay (verbatim only to agent:configure holders, redacted otherwise, fail-closed) with an admin ETag, and GET …/config/revisions/{rev} returns one revision the same way; PUT saves a new revision with If-Match (428 without, 409 on conflict, 200 for a no-op), validating the overlay on its own and against the instances a save validates against (only errors the overlay introduces block; file-origin errors are warnings). Needs agent:configure to write.

Size: +1180 -0 = 1180 changed lines (without docs/go.sum).

size-exception: over 1000 LOC because of the tests that cover this layer; the implementation part is well under 1000.

Verification

Each layer builds on its own: go build, go vet (also with -tags integration), golangci-lint run and go test ./... pass, and make swag leaves the tree clean. Integration suites for the packages this layer touches pass locally on testcontainers Postgres.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 682596d3-24dd-49ca-9dce-46985980572c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gusfcarvalho]

ccf-review: APPROVE

1 Should-fix.

Stack (gh stack 484): #469 → #470 → #471 → #472 → #473 → #474 → #475 → #476 → #477 → #478 → #479 → #480 → #481 → #482 → #483

[gusfcarvalho]

[Should-fix] CORE-DUP-001 · Logic or literal duplicated where it must stay in sync

agentConfigBodyLimit (4 × 256 KiB) and agentConfigBodyLimitStr = "1M" are the same limit in two forms that must stay equal. The comment says so, but nothing enforces it. readJSONBody(ctx, agentConfigBodyLimit) already returns 413 above the limit, so the extra echomiddleware.BodyLimit on PUT (and later preview/revert) is a second, hand-synced copy.

Why: Copies drift: one gets fixed or changed and the other does not.
Fix: Drop echomiddleware.BodyLimit(agentConfigBodyLimitStr) and rely on readJSONBody, or derive the string with strconv.Itoa(agentConfigBodyLimit) (echo's BodyLimit accepts a plain byte count).

_{ccf-review · 2d2585c08f9a · rules@6be9e11b8bc6}