feat!: move query/logs/routes/diagram/agent-view endpoints under /environments/{envSlug}/

P3C — the last data/query wave of the taxonomy migration. Every user-
facing read endpoint that was keyed on env-as-query-param is now under
the env-scoped URL, making env impossible to omit and unambiguous in
server-side tenant+env filtering.

Server:
- SearchController: /api/v1/search/** → /api/v1/environments/{envSlug}/...
  Endpoints: /executions (GET), /executions/search (POST), /stats,
  /stats/timeseries, /stats/timeseries/by-app, /stats/timeseries/by-route,
  /stats/punchcard, /attributes/keys, /errors/top. Env comes from path.
- LogQueryController: /api/v1/logs → /api/v1/environments/{envSlug}/logs.
- RouteCatalogController: /api/v1/routes/catalog → /api/v1/environments/
  {envSlug}/routes. Env filter unconditional (path).
- RouteMetricsController: /api/v1/routes/metrics →
  /api/v1/environments/{envSlug}/routes/metrics (and /metrics/processors).
- DiagramRenderController: /{contentHash}/render stays flat (hashes are
  globally unique). Find-by-route moved to /api/v1/environments/{envSlug}/
  apps/{appSlug}/routes/{routeId}/diagram — the old GET /diagrams?...
  handler is removed.
- Agent views split cleanly:
  - AgentListController (new): /api/v1/environments/{envSlug}/agents
  - AgentEventsController: /api/v1/environments/{envSlug}/agents/events
  - AgentMetricsController: /api/v1/environments/{envSlug}/agents/
    {agentId}/metrics — now also rejects cross-env agents (404) as a
    defense-in-depth check, fulfilling B3.
  Agent self-service endpoints (register/refresh/heartbeat/deregister)
  remain flat at /api/v1/agents/** — JWT-authoritative.

SPA:
- queries/agents.ts, agent-metrics.ts, logs.ts, catalog.ts (route
  metrics only; /catalog stays flat), processor-metrics.ts,
  executions.ts (attributes/keys, stats, timeseries, search),
  dashboard.ts (all stats/errors/punchcard), correlation.ts,
  diagrams.ts (by-route) — all rewritten to env-scoped URLs.
- Hooks now either read env from useEnvironmentStore internally or
  require it as an argument. Query keys include env so switching env
  invalidates caches.
- useAgents/useAgentEvents signature simplified — env is no longer a
  parameter; it's read from the store. Callers (LayoutShell,
  AgentHealth, AgentInstance) updated accordingly.
- LogTab and useStartupLogs thread env through to useLogs.
- envFetch helper introduced in executions.ts for env-prefixed raw
  fetch until schema.d.ts is regenerated against the new backend.

BREAKING CHANGE: All these flat paths are removed:
  /api/v1/search/**, /api/v1/logs, /api/v1/routes/catalog,
  /api/v1/routes/metrics (and /processors), /api/v1/diagrams
  (lookup), /api/v1/agents (list), /api/v1/agents/events-log,
  /api/v1/agents/{id}/metrics, /api/v1/agent-events.
Clients must use the /api/v1/environments/{envSlug}/... equivalents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/src/components/ExecutionDiagram/tabs/LogTab.tsx

@@ -4,6 +4,7 @@ import { Input, Button, LogViewer } from '@cameleer/design-system';
 import type { LogEntry } from '@cameleer/design-system';
 import { useLogs } from '../../../api/queries/logs';
 import type { LogEntryResponse } from '../../../api/queries/logs';
+import { useEnvironmentStore } from '../../../api/environment-store';
 import { mapLogLevel } from '../../../utils/agent-utils';
 import logStyles from './LogTab.module.css';
 import diagramStyles from '../ExecutionDiagram.module.css';
@@ -27,9 +28,10 @@ export function LogTab({ applicationId, exchangeId, processorId }: LogTabProps)
   const [filter, setFilter] = useState('');
   const navigate = useNavigate();
 
+  const environment = useEnvironmentStore((s) => s.environment) ?? '';
   const { data: logPage, isLoading } = useLogs(
-    { exchangeId, limit: 500 },
-    { enabled: !!exchangeId },
+    { exchangeId, environment, limit: 500 },
+    { enabled: !!exchangeId && !!environment },
   );
 
   const entries = useMemo<LogEntry[]>(() => {

ui/src/components/LayoutShell.tsx

@@ -303,8 +303,10 @@ function LayoutContent() {
   const setSelectedEnvRaw = useEnvironmentStore((s) => s.setEnvironment);
 
   const { data: catalog } = useCatalog(selectedEnv);
-  const { data: allAgents } = useAgents();  // unfiltered — for environment discovery
-  const { data: agents } = useAgents(undefined, undefined, selectedEnv);  // filtered — for sidebar/search
+  // Env is always required now (path-based endpoint). For cross-env "all agents"
+  // we'd need a separate flat endpoint; sidebar uses env-filtered list directly.
+  const { data: agents } = useAgents();  // env pulled from store internally
+  const allAgents = agents;
   const { data: attributeKeys } = useAttributeKeys();
   const { data: envRecords = [] } = useEnvironments();