fix: commands respect selected environment

Backend: AgentRegistryService gains findByApplicationAndEnvironment()
and environment-aware addGroupCommandWithReplies() overload.
AgentCommandController and ApplicationConfigController accept optional
environment query parameter. When set, commands only target agents in
that environment. Backward compatible — null means all environments.

Frontend: All command mutations (config update, route control, traced
processors, tap config, route recording) now pass selectedEnv to the
backend via query parameter.

Prevents cross-environment command leakage — e.g., updating config for
prod no longer pushes to dev agents.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/pages/AppsTab/AppsTab.tsx

@@ -238,19 +238,22 @@ function CreateAppView({ environments, selectedEnv }: { environments: Environmen
       // 4. Save agent config (will be pushed to agent on first connect)
       setStep('Saving monitoring config...');
       await updateAgentConfig.mutateAsync({
-        application: slug.trim(),
-        version: 0,
-        engineLevel,
-        payloadCaptureMode: payloadCapture,
-        applicationLogLevel: appLogLevel,
-        agentLogLevel,
-        metricsEnabled,
-        samplingRate: parseFloat(samplingRate) || 1.0,
-        compressSuccess,
-        tracedProcessors: {},
-        taps: [],
-        tapVersion: 0,
-        routeRecording: {},
+        config: {
+          application: slug.trim(),
+          version: 0,
+          engineLevel,
+          payloadCaptureMode: payloadCapture,
+          applicationLogLevel: appLogLevel,
+          agentLogLevel,
+          metricsEnabled,
+          samplingRate: parseFloat(samplingRate) || 1.0,
+          compressSuccess,
+          tracedProcessors: {},
+          taps: [],
+          tapVersion: 0,
+          routeRecording: {},
+        },
+        environment: selectedEnv,
       });
 
       // 5. Deploy (if requested)
@@ -814,13 +817,16 @@ function ConfigSubTab({ app, environment }: { app: App; environment?: Environmen
     if (agentConfig) {
       try {
         await updateAgentConfig.mutateAsync({
-          ...agentConfig,
-          engineLevel, payloadCaptureMode: payloadCapture,
-          applicationLogLevel: appLogLevel, agentLogLevel,
-          metricsEnabled, samplingRate: parseFloat(samplingRate) || 1.0,
-          compressSuccess,
-          tracedProcessors: tracedDraft,
-          routeRecording: routeRecordingDraft,
+          config: {
+            ...agentConfig,
+            engineLevel, payloadCaptureMode: payloadCapture,
+            applicationLogLevel: appLogLevel, agentLogLevel,
+            metricsEnabled, samplingRate: parseFloat(samplingRate) || 1.0,
+            compressSuccess,
+            tracedProcessors: tracedDraft,
+            routeRecording: routeRecordingDraft,
+          },
+          environment: environment?.slug,
         });
       } catch { toast({ title: 'Failed to save agent config', variant: 'error', duration: 86_400_000 }); return; }
     }