feat!: move query/logs/routes/diagram/agent-view endpoints under /environments/{envSlug}/

P3C — the last data/query wave of the taxonomy migration. Every user-
facing read endpoint that was keyed on env-as-query-param is now under
the env-scoped URL, making env impossible to omit and unambiguous in
server-side tenant+env filtering.

Server:
- SearchController: /api/v1/search/** → /api/v1/environments/{envSlug}/...
  Endpoints: /executions (GET), /executions/search (POST), /stats,
  /stats/timeseries, /stats/timeseries/by-app, /stats/timeseries/by-route,
  /stats/punchcard, /attributes/keys, /errors/top. Env comes from path.
- LogQueryController: /api/v1/logs → /api/v1/environments/{envSlug}/logs.
- RouteCatalogController: /api/v1/routes/catalog → /api/v1/environments/
  {envSlug}/routes. Env filter unconditional (path).
- RouteMetricsController: /api/v1/routes/metrics →
  /api/v1/environments/{envSlug}/routes/metrics (and /metrics/processors).
- DiagramRenderController: /{contentHash}/render stays flat (hashes are
  globally unique). Find-by-route moved to /api/v1/environments/{envSlug}/
  apps/{appSlug}/routes/{routeId}/diagram — the old GET /diagrams?...
  handler is removed.
- Agent views split cleanly:
  - AgentListController (new): /api/v1/environments/{envSlug}/agents
  - AgentEventsController: /api/v1/environments/{envSlug}/agents/events
  - AgentMetricsController: /api/v1/environments/{envSlug}/agents/
    {agentId}/metrics — now also rejects cross-env agents (404) as a
    defense-in-depth check, fulfilling B3.
  Agent self-service endpoints (register/refresh/heartbeat/deregister)
  remain flat at /api/v1/agents/** — JWT-authoritative.

SPA:
- queries/agents.ts, agent-metrics.ts, logs.ts, catalog.ts (route
  metrics only; /catalog stays flat), processor-metrics.ts,
  executions.ts (attributes/keys, stats, timeseries, search),
  dashboard.ts (all stats/errors/punchcard), correlation.ts,
  diagrams.ts (by-route) — all rewritten to env-scoped URLs.
- Hooks now either read env from useEnvironmentStore internally or
  require it as an argument. Query keys include env so switching env
  invalidates caches.
- useAgents/useAgentEvents signature simplified — env is no longer a
  parameter; it's read from the store. Callers (LayoutShell,
  AgentHealth, AgentInstance) updated accordingly.
- LogTab and useStartupLogs thread env through to useLogs.
- envFetch helper introduced in executions.ts for env-prefixed raw
  fetch until schema.d.ts is regenerated against the new backend.

BREAKING CHANGE: All these flat paths are removed:
  /api/v1/search/**, /api/v1/logs, /api/v1/routes/catalog,
  /api/v1/routes/metrics (and /processors), /api/v1/diagrams
  (lookup), /api/v1/agents (list), /api/v1/agents/events-log,
  /api/v1/agents/{id}/metrics, /api/v1/agent-events.
Clients must use the /api/v1/environments/{envSlug}/... equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/src/api/queries/dashboard.ts

@@ -42,11 +42,12 @@ export interface GroupedTimeseries {
 export function useTimeseriesByApp(from?: string, to?: string, environment?: string) {
   const refetchInterval = useRefreshInterval(30_000);
   return useQuery({
-    queryKey: ['dashboard', 'timeseries-by-app', from, to, environment],
-    queryFn: () => fetchJson<GroupedTimeseries>('/search/stats/timeseries/by-app', {
-      from, to, buckets: '24', environment,
+    queryKey: ['dashboard', 'timeseries-by-app', environment, from, to],
+    queryFn: () => fetchJson<GroupedTimeseries>(
+      `/environments/${encodeURIComponent(environment!)}/stats/timeseries/by-app`, {
+      from, to, buckets: '24',
     }),
-    enabled: !!from,
+    enabled: !!from && !!environment,
     placeholderData: (prev: GroupedTimeseries | undefined) => prev,
     refetchInterval,
   });
@@ -57,11 +58,12 @@ export function useTimeseriesByApp(from?: string, to?: string, environment?: str
 export function useTimeseriesByRoute(from?: string, to?: string, application?: string, environment?: string) {
   const refetchInterval = useRefreshInterval(30_000);
   return useQuery({
-    queryKey: ['dashboard', 'timeseries-by-route', from, to, application, environment],
-    queryFn: () => fetchJson<GroupedTimeseries>('/search/stats/timeseries/by-route', {
-      from, to, application, buckets: '24', environment,
+    queryKey: ['dashboard', 'timeseries-by-route', environment, from, to, application],
+    queryFn: () => fetchJson<GroupedTimeseries>(
+      `/environments/${encodeURIComponent(environment!)}/stats/timeseries/by-route`, {
+      from, to, application, buckets: '24',
     }),
-    enabled: !!from && !!application,
+    enabled: !!from && !!application && !!environment,
     placeholderData: (prev: GroupedTimeseries | undefined) => prev,
     refetchInterval,
   });
@@ -82,11 +84,12 @@ export interface TopError {
 export function useTopErrors(from?: string, to?: string, application?: string, routeId?: string, environment?: string) {
   const refetchInterval = useRefreshInterval(10_000);
   return useQuery({
-    queryKey: ['dashboard', 'top-errors', from, to, application, routeId, environment],
-    queryFn: () => fetchJson<TopError[]>('/search/errors/top', {
-      from, to, application, routeId, limit: '5', environment,
+    queryKey: ['dashboard', 'top-errors', environment, from, to, application, routeId],
+    queryFn: () => fetchJson<TopError[]>(
+      `/environments/${encodeURIComponent(environment!)}/errors/top`, {
+      from, to, application, routeId, limit: '5',
     }),
-    enabled: !!from,
+    enabled: !!from && !!environment,
     placeholderData: (prev: TopError[] | undefined) => prev,
     refetchInterval,
   });
@@ -104,8 +107,10 @@ export interface PunchcardCell {
 export function usePunchcard(application?: string, environment?: string) {
   const refetchInterval = useRefreshInterval(60_000);
   return useQuery({
-    queryKey: ['dashboard', 'punchcard', application, environment],
-    queryFn: () => fetchJson<PunchcardCell[]>('/search/stats/punchcard', { application, environment }),
+    queryKey: ['dashboard', 'punchcard', environment, application],
+    queryFn: () => fetchJson<PunchcardCell[]>(
+      `/environments/${encodeURIComponent(environment!)}/stats/punchcard`, { application }),
+    enabled: !!environment,
     placeholderData: (prev: PunchcardCell[] | undefined) => prev ?? [],
     refetchInterval,
   });