feat!: move query/logs/routes/diagram/agent-view endpoints under /environments/{envSlug}/

P3C — the last data/query wave of the taxonomy migration. Every user-
facing read endpoint that was keyed on env-as-query-param is now under
the env-scoped URL, making env impossible to omit and unambiguous in
server-side tenant+env filtering.

Server:
- SearchController: /api/v1/search/** → /api/v1/environments/{envSlug}/...
  Endpoints: /executions (GET), /executions/search (POST), /stats,
  /stats/timeseries, /stats/timeseries/by-app, /stats/timeseries/by-route,
  /stats/punchcard, /attributes/keys, /errors/top. Env comes from path.
- LogQueryController: /api/v1/logs → /api/v1/environments/{envSlug}/logs.
- RouteCatalogController: /api/v1/routes/catalog → /api/v1/environments/
  {envSlug}/routes. Env filter unconditional (path).
- RouteMetricsController: /api/v1/routes/metrics →
  /api/v1/environments/{envSlug}/routes/metrics (and /metrics/processors).
- DiagramRenderController: /{contentHash}/render stays flat (hashes are
  globally unique). Find-by-route moved to /api/v1/environments/{envSlug}/
  apps/{appSlug}/routes/{routeId}/diagram — the old GET /diagrams?...
  handler is removed.
- Agent views split cleanly:
  - AgentListController (new): /api/v1/environments/{envSlug}/agents
  - AgentEventsController: /api/v1/environments/{envSlug}/agents/events
  - AgentMetricsController: /api/v1/environments/{envSlug}/agents/
    {agentId}/metrics — now also rejects cross-env agents (404) as a
    defense-in-depth check, fulfilling B3.
  Agent self-service endpoints (register/refresh/heartbeat/deregister)
  remain flat at /api/v1/agents/** — JWT-authoritative.

SPA:
- queries/agents.ts, agent-metrics.ts, logs.ts, catalog.ts (route
  metrics only; /catalog stays flat), processor-metrics.ts,
  executions.ts (attributes/keys, stats, timeseries, search),
  dashboard.ts (all stats/errors/punchcard), correlation.ts,
  diagrams.ts (by-route) — all rewritten to env-scoped URLs.
- Hooks now either read env from useEnvironmentStore internally or
  require it as an argument. Query keys include env so switching env
  invalidates caches.
- useAgents/useAgentEvents signature simplified — env is no longer a
  parameter; it's read from the store. Callers (LayoutShell,
  AgentHealth, AgentInstance) updated accordingly.
- LogTab and useStartupLogs thread env through to useLogs.
- envFetch helper introduced in executions.ts for env-prefixed raw
  fetch until schema.d.ts is regenerated against the new backend.

BREAKING CHANGE: All these flat paths are removed:
  /api/v1/search/**, /api/v1/logs, /api/v1/routes/catalog,
  /api/v1/routes/metrics (and /processors), /api/v1/diagrams
  (lookup), /api/v1/agents (list), /api/v1/agents/events-log,
  /api/v1/agents/{id}/metrics, /api/v1/agent-events.
Clients must use the /api/v1/environments/{envSlug}/... equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/src/api/queries/executions.ts

@@ -1,9 +1,35 @@
 import { useQuery } from '@tanstack/react-query';
 import { api } from '../client';
+import { config as appConfig } from '../../config';
+import { useAuthStore } from '../../auth/auth-store';
 import { useEnvironmentStore } from '../environment-store';
+import type { components } from '../schema';
 import type { SearchRequest } from '../types';
 import { useLiveQuery } from './use-refresh-interval';
 
+type ExecutionStats = components['schemas']['ExecutionStats'];
+type StatsTimeseries = components['schemas']['StatsTimeseries'];
+type SearchResultSummary = components['schemas']['SearchResultExecutionSummary'];
+
+// Raw authenticated fetch — used for env-scoped endpoints where the
+// generated openapi schema is still on the old flat shape. Switch back to
+// api.GET once the schema is regenerated against a running P3-era backend.
+async function envFetch<T>(envSlug: string, path: string, init?: RequestInit): Promise<T> {
+  const token = useAuthStore.getState().accessToken;
+  const res = await fetch(
+    `${appConfig.apiBaseUrl}/environments/${encodeURIComponent(envSlug)}${path}`, {
+      ...init,
+      headers: {
+        'Content-Type': 'application/json',
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        'X-Cameleer-Protocol-Version': '1',
+        ...init?.headers,
+      },
+    });
+  if (!res.ok) throw new Error(`API error: ${res.status}`);
+  return res.json() as Promise<T>;
+}
+
 export function useExecutionStats(
   timeFrom: string | undefined,
   timeTo: string | undefined,
@@ -13,23 +39,15 @@ export function useExecutionStats(
 ) {
   const live = useLiveQuery(10_000);
   return useQuery({
-    queryKey: ['executions', 'stats', timeFrom, timeTo, routeId, application, environment],
+    queryKey: ['executions', 'stats', environment, timeFrom, timeTo, routeId, application],
     queryFn: async () => {
-      const { data, error } = await api.GET('/search/stats', {
-        params: {
-          query: {
-            from: timeFrom!,
-            to: timeTo || undefined,
-            routeId: routeId || undefined,
-            application: application || undefined,
-            environment: environment || undefined,
-          },
-        },
-      });
-      if (error) throw new Error('Failed to load stats');
-      return data!;
+      const params = new URLSearchParams({ from: timeFrom! });
+      if (timeTo) params.set('to', timeTo);
+      if (routeId) params.set('routeId', routeId);
+      if (application) params.set('application', application);
+      return envFetch<ExecutionStats>(environment!, `/stats?${params}`);
     },
-    enabled: !!timeFrom && live.enabled,
+    enabled: !!timeFrom && !!environment && live.enabled,
     placeholderData: (prev) => prev,
     refetchInterval: live.refetchInterval,
   });
@@ -39,34 +57,23 @@ export function useAttributeKeys() {
   const environment = useEnvironmentStore((s) => s.environment);
   return useQuery({
     queryKey: ['search', 'attribute-keys', environment],
-    queryFn: async () => {
-      const token = (await import('../../auth/auth-store')).useAuthStore.getState().accessToken;
-      const { config } = await import('../../config');
-      const res = await fetch(
-        `${config.apiBaseUrl}/search/attributes/keys?environment=${encodeURIComponent(environment!)}`,
-        { headers: { Authorization: `Bearer ${token}` } },
-      );
-      if (!res.ok) throw new Error('Failed to load attribute keys');
-      return res.json() as Promise<string[]>;
-    },
+    queryFn: () => envFetch<string[]>(environment!, '/attributes/keys'),
     enabled: !!environment,
     staleTime: 60_000,
   });
 }
 
 export function useSearchExecutions(filters: SearchRequest, live = false) {
+  const environment = useEnvironmentStore((s) => s.environment);
   const liveQuery = useLiveQuery(5_000);
   return useQuery({
-    queryKey: ['executions', 'search', filters],
-    queryFn: async () => {
-      const { data, error } = await api.POST('/search/executions', {
-        body: filters,
-      });
-      if (error) throw new Error('Search failed');
-      return data!;
-    },
+    queryKey: ['executions', 'search', environment, filters],
+    queryFn: () => envFetch<SearchResultSummary>(environment!, '/executions/search', {
+      method: 'POST',
+      body: JSON.stringify(filters),
+    }),
     placeholderData: (prev) => prev,
-    enabled: live ? liveQuery.enabled : true,
+    enabled: !!environment && (live ? liveQuery.enabled : true),
     refetchInterval: live ? liveQuery.refetchInterval : false,
   });
 }
@@ -80,24 +87,15 @@ export function useStatsTimeseries(
 ) {
   const live = useLiveQuery(30_000);
   return useQuery({
-    queryKey: ['executions', 'timeseries', timeFrom, timeTo, routeId, application, environment],
+    queryKey: ['executions', 'timeseries', environment, timeFrom, timeTo, routeId, application],
     queryFn: async () => {
-      const { data, error } = await api.GET('/search/stats/timeseries', {
-        params: {
-          query: {
-            from: timeFrom!,
-            to: timeTo || undefined,
-            buckets: 24,
-            routeId: routeId || undefined,
-            application: application || undefined,
-            environment: environment || undefined,
-          },
-        },
-      });
-      if (error) throw new Error('Failed to load timeseries');
-      return data!;
+      const params = new URLSearchParams({ from: timeFrom!, buckets: '24' });
+      if (timeTo) params.set('to', timeTo);
+      if (routeId) params.set('routeId', routeId);
+      if (application) params.set('application', application);
+      return envFetch<StatsTimeseries>(environment!, `/stats/timeseries?${params}`);
     },
-    enabled: !!timeFrom && live.enabled,
+    enabled: !!timeFrom && !!environment && live.enabled,
     placeholderData: (prev) => prev,
     refetchInterval: live.refetchInterval,
   });