feat(api): admin agent instances, CORS and authz coverage (15/15)

[ccf-lisa]

Part 15/15 of the agent remote-configuration stack

This stack splits #465 into reviewable layers of at most ~1000 changed lines each (counted without docs/, go.sum and Markdown). The last layer's tree is identical to #465, which already has its review history.

Stacked on #482 (lisa/agent-config/14-admin-config-preview). Review and merge in order.

What's in this layer

Fifteenth and last layer of the agent remote-configuration stack (split from #465): GET /api/admin/agents/{id}/instances lists an agent's reporting instances with derived status, sync status and per-status counts, and GET …/instances/{instanceId} returns one with its redacted base/effective config; CORS allows If-Match/If-None-Match and exposes ETag for the UI; the server recovers handler panics as 500s; builtin/Cedar authz matrices over every admin agent-config route, and the Cedar docs. The tree now matches #465.

Size: +467 -1 = 468 changed lines (without docs/go.sum).

Verification

Each layer builds on its own: go build, go vet (also with -tags integration), golangci-lint run and go test ./... pass, and make swag leaves the tree clean. Integration suites for the packages this layer touches pass locally on testcontainers Postgres.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 44650e32-57c6-4c1e-af18-17e06f00ec23

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}