fix: commands respect selected environment

Backend: AgentRegistryService gains findByApplicationAndEnvironment()
and environment-aware addGroupCommandWithReplies() overload.
AgentCommandController and ApplicationConfigController accept optional
environment query parameter. When set, commands only target agents in
that environment. Backward compatible — null means all environments.

Frontend: All command mutations (config update, route control, traced
processors, tap config, route recording) now pass selectedEnv to the
backend via query parameter.

Prevents cross-environment command leakage — e.g., updating config for
prod no longer pushes to dev agents.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/queries/commands.ts

@@ -73,8 +73,9 @@ export interface ConfigUpdateResponse {
 export function useUpdateApplicationConfig() {
   const queryClient = useQueryClient()
   return useMutation({
-    mutationFn: async (config: ApplicationConfig) => {
-      const res = await authFetch(`/config/${config.application}`, {
+    mutationFn: async ({ config, environment }: { config: ApplicationConfig; environment?: string }) => {
+      const envParam = environment ? `?environment=${encodeURIComponent(environment)}` : ''
+      const res = await authFetch(`/config/${config.application}${envParam}`, {
         method: 'PUT',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(config),
@@ -119,12 +120,14 @@ interface SendGroupCommandParams {
   group: string
   type: string
   payload: Record<string, unknown>
+  environment?: string
 }
 
 export function useSendGroupCommand() {
   return useMutation({
-    mutationFn: async ({ group, type, payload }: SendGroupCommandParams) => {
-      const res = await authFetch(`/agents/groups/${encodeURIComponent(group)}/commands`, {
+    mutationFn: async ({ group, type, payload, environment }: SendGroupCommandParams) => {
+      const envParam = environment ? `?environment=${encodeURIComponent(environment)}` : ''
+      const res = await authFetch(`/agents/groups/${encodeURIComponent(group)}/commands${envParam}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ type, payload }),
@@ -174,12 +177,14 @@ export function useTestExpression() {
 
 export function useSendRouteCommand() {
   return useMutation({
-    mutationFn: async ({ application, action, routeId }: {
+    mutationFn: async ({ application, action, routeId, environment }: {
       application: string
       action: 'start' | 'stop' | 'suspend' | 'resume'
       routeId: string
+      environment?: string
     }) => {
-      const res = await authFetch(`/agents/groups/${encodeURIComponent(application)}/commands`, {
+      const envParam = environment ? `?environment=${encodeURIComponent(environment)}` : ''
+      const res = await authFetch(`/agents/groups/${encodeURIComponent(application)}/commands${envParam}`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ type: 'route-control', payload: { routeId, action, nonce: crypto.randomUUID() } }),