Audit every state-changing manager operation

[lvwerra]

Why

Manager mutations were only partially attributable: agent-to-agent calls carried ?from=, while operator/UI operations and manager endpoints such as group creation did not. There was also no durable event trail, so creating, changing, moving, or deleting state could not be reconstructed later.

This complements #46: its group-creation example now keeps ?from=$AM_ID, and this PR makes that origin meaningful everywhere.

What changed

• Require a known origin for every POST, PUT, PATCH, and DELETE under /api/.
  • local agents use their session id (?from=$AM_ID)
  • the browser API stamps mutations with the stable operator origin
  • remote agents use their immutable remote:<name> id; route-derived fallback keeps existing polling loops working
• Append every accepted mutation and its outcome to durable DATA_DIR/operations.jsonl.
• Add bounded, newest-first GET /api/operations?limit=...&before=... access and document it in the generated environment skill.
• Record method, path, replay-relevant query/body fields, origin metadata, result ids, status, and duration.
• Distinguish session/agent creation with and without an initial prompt. Prompts, messages, uploaded/file content, credentials, push endpoints, and other sensitive/large values are represented by presence, byte/character count, and SHA-256 rather than copied into the audit log.
• Put from=$AM_ID on the notification examples too.

Test servers opt into a clearly named missing-origin bypass so existing endpoint-focused fixtures remain scoped to what they test; production never enables it.

Verification

• node test/operations.test.mjs — 14 checks covering origin enforcement, operator/agent attribution, group and session creation, with/without-prompt distinction, redaction/hashing, result ids, and query reconstruction.
• node --check src/operations.js
• node --check src/index.js
• npm run build in web/