feat!: move query/logs/routes/diagram/agent-view endpoints under /environments/{envSlug}/

P3C — the last data/query wave of the taxonomy migration. Every user-
facing read endpoint that was keyed on env-as-query-param is now under
the env-scoped URL, making env impossible to omit and unambiguous in
server-side tenant+env filtering.

Server:
- SearchController: /api/v1/search/** → /api/v1/environments/{envSlug}/...
  Endpoints: /executions (GET), /executions/search (POST), /stats,
  /stats/timeseries, /stats/timeseries/by-app, /stats/timeseries/by-route,
  /stats/punchcard, /attributes/keys, /errors/top. Env comes from path.
- LogQueryController: /api/v1/logs → /api/v1/environments/{envSlug}/logs.
- RouteCatalogController: /api/v1/routes/catalog → /api/v1/environments/
  {envSlug}/routes. Env filter unconditional (path).
- RouteMetricsController: /api/v1/routes/metrics →
  /api/v1/environments/{envSlug}/routes/metrics (and /metrics/processors).
- DiagramRenderController: /{contentHash}/render stays flat (hashes are
  globally unique). Find-by-route moved to /api/v1/environments/{envSlug}/
  apps/{appSlug}/routes/{routeId}/diagram — the old GET /diagrams?...
  handler is removed.
- Agent views split cleanly:
  - AgentListController (new): /api/v1/environments/{envSlug}/agents
  - AgentEventsController: /api/v1/environments/{envSlug}/agents/events
  - AgentMetricsController: /api/v1/environments/{envSlug}/agents/
    {agentId}/metrics — now also rejects cross-env agents (404) as a
    defense-in-depth check, fulfilling B3.
  Agent self-service endpoints (register/refresh/heartbeat/deregister)
  remain flat at /api/v1/agents/** — JWT-authoritative.

SPA:
- queries/agents.ts, agent-metrics.ts, logs.ts, catalog.ts (route
  metrics only; /catalog stays flat), processor-metrics.ts,
  executions.ts (attributes/keys, stats, timeseries, search),
  dashboard.ts (all stats/errors/punchcard), correlation.ts,
  diagrams.ts (by-route) — all rewritten to env-scoped URLs.
- Hooks now either read env from useEnvironmentStore internally or
  require it as an argument. Query keys include env so switching env
  invalidates caches.
- useAgents/useAgentEvents signature simplified — env is no longer a
  parameter; it's read from the store. Callers (LayoutShell,
  AgentHealth, AgentInstance) updated accordingly.
- LogTab and useStartupLogs thread env through to useLogs.
- envFetch helper introduced in executions.ts for env-prefixed raw
  fetch until schema.d.ts is regenerated against the new backend.

BREAKING CHANGE: All these flat paths are removed:
  /api/v1/search/**, /api/v1/logs, /api/v1/routes/catalog,
  /api/v1/routes/metrics (and /processors), /api/v1/diagrams
  (lookup), /api/v1/agents (list), /api/v1/agents/events-log,
  /api/v1/agents/{id}/metrics, /api/v1/agent-events.
Clients must use the /api/v1/environments/{envSlug}/... equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/src/api/queries/logs.ts

@@ -32,7 +32,8 @@ export interface LogSearchParams {
   application?: string;
   agentId?: string;
   source?: string;
-  environment?: string;
+  /** Required: env in path */
+  environment: string;
   exchangeId?: string;
   logger?: string;
   from?: string;
@@ -50,7 +51,6 @@ async function fetchLogs(params: LogSearchParams): Promise<LogSearchPageResponse
   if (params.application) urlParams.set('application', params.application);
   if (params.agentId) urlParams.set('agentId', params.agentId);
   if (params.source) urlParams.set('source', params.source);
-  if (params.environment) urlParams.set('environment', params.environment);
   if (params.exchangeId) urlParams.set('exchangeId', params.exchangeId);
   if (params.logger) urlParams.set('logger', params.logger);
   if (params.from) urlParams.set('from', params.from);
@@ -59,7 +59,8 @@ async function fetchLogs(params: LogSearchParams): Promise<LogSearchPageResponse
   if (params.limit) urlParams.set('limit', String(params.limit));
   if (params.sort) urlParams.set('sort', params.sort);
 
-  const res = await fetch(`${config.apiBaseUrl}/logs?${urlParams}`, {
+  const res = await fetch(
+    `${config.apiBaseUrl}/environments/${encodeURIComponent(params.environment)}/logs?${urlParams}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       'X-Cameleer-Protocol-Version': '1',
@@ -81,7 +82,7 @@ export function useLogs(
   return useQuery({
     queryKey: ['logs', params],
     queryFn: () => fetchLogs(params),
-    enabled: options?.enabled ?? true,
+    enabled: (options?.enabled ?? true) && !!params.environment,
     placeholderData: (prev) => prev,
     refetchInterval: options?.refetchInterval ?? defaultRefetch,
     staleTime: 300,
@@ -107,7 +108,7 @@ export function useApplicationLogs(
     application: application || undefined,
     agentId: agentId || undefined,
     source: options?.source || undefined,
-    environment: selectedEnv || undefined,
+    environment: selectedEnv ?? '',
     exchangeId: options?.exchangeId || undefined,
     from: useTimeRange ? timeRange.start.toISOString() : undefined,
     to: useTimeRange ? to : undefined,
@@ -120,7 +121,7 @@ export function useApplicationLogs(
       useTimeRange ? to : null,
       options?.limit, options?.exchangeId, options?.source],
     queryFn: () => fetchLogs(params),
-    enabled: !!application,
+    enabled: !!application && !!selectedEnv,
     placeholderData: (prev) => prev,
     refetchInterval,
   });
@@ -144,7 +145,7 @@ export function useStartupLogs(
 ) {
   const params: LogSearchParams = {
     application: application || undefined,
-    environment: environment || undefined,
+    environment: environment ?? '',
     source: 'container',
     from: deployCreatedAt || undefined,
     sort: 'asc',
@@ -152,7 +153,7 @@ export function useStartupLogs(
   };
 
   return useLogs(params, {
-    enabled: !!application && !!deployCreatedAt,
+    enabled: !!application && !!deployCreatedAt && !!environment,
     refetchInterval: isStarting ? 3_000 : false,
   });
 }