feat!: move config & settings under /api/v1/environments/{envSlug}/...

P3A of the taxonomy migration. Env-scoped config and settings endpoints
now live under the env-prefixed URL shape, making env a first-class
path segment instead of a query param. Agent-authoritative config is
split off into a dedicated endpoint so agent env comes from the JWT
only — never spoofable via URL.

Server:
- ApplicationConfigController: @RequestMapping("/api/v1/environments/
  {envSlug}"). Handlers use @EnvPath Environment env, appSlug as
  @PathVariable. Removed the dual-mode resolveEnvironmentForRead —
  user flow only; agent flow moved to AgentConfigController.
- AgentConfigController (new): GET /api/v1/agents/config. Reads
  instanceId from JWT subject, resolves (app, env) from registry,
  returns AppConfigResponse. Registry miss → falls back to JWT env
  claim for environment, but 404s if application cannot be derived
  (no other source without registry).
- AppSettingsController: @RequestMapping("/api/v1/environments/
  {envSlug}"). List at /app-settings, per-app at /apps/{appSlug}/
  settings. Access class-wide PreAuthorize preserved (ADMIN/OPERATOR).

SPA:
- commands.ts: useAllApplicationConfigs, useApplicationConfig,
  useUpdateApplicationConfig, useProcessorRouteMapping,
  useTestExpression — rewritten URLs to /environments/{env}/apps/
  {app}/... shape. environment now required on every call. Query
  keys include environment so cache is env-scoped.
- dashboard.ts: useAppSettings, useAllAppSettings, useUpdateAppSettings
  rewritten.
- TapConfigModal: new required environment prop; callers updated.
- RouteDetail, ExchangesPage: thread selectedEnv into test-expression
  and modal.

Config changes in SecurityConfig for the new shape landed earlier in
P0.2; no security rule changes needed in this commit.

BREAKING CHANGE: /api/v1/config/** and /api/v1/admin/app-settings/**
paths removed. Agents must use /api/v1/agents/config instead of
GET /api/v1/config/{app}; users must use /api/v1/environments/{env}/
apps/{app}/config and /api/v1/environments/{env}/apps/{app}/settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/src/components/TapConfigModal.tsx

@@ -43,6 +43,8 @@ export interface TapConfigModalProps {
   defaultProcessorId?: string;
   /** Application name (for test expression API) */
   application: string;
+  /** Environment slug (for test expression API) */
+  environment: string;
   /** Current application config (taps array will be modified) */
   config: ApplicationConfig;
   /** Called with the updated config to persist */
@@ -53,7 +55,7 @@ export interface TapConfigModalProps {
 
 export function TapConfigModal({
   open, onClose, tap, processorOptions, defaultProcessorId,
-  application, config, onSave, onDelete,
+  application, environment, config, onSave, onDelete,
 }: TapConfigModalProps) {
   const isEdit = !!tap;
 
@@ -125,7 +127,7 @@ export function TapConfigModal({
 
   function handleTest() {
     testMutation.mutate(
-      { application, expression, language, body: testPayload, target },
+      { application, environment, expression, language, body: testPayload, target },
       {
         onSuccess: (data) => setTestResult(data),
         onError: (err) => setTestResult({ error: (err as Error).message }),