…n server case, need to discuss more

…and catalog, capability filtering, and payload including status, heartbeat, version, system_info, raw capabilities, and allowed commands. Unit tests cover filtering and payload cases.remove duplicates

…don't push anything to agent

Problem:
Status Panel agents authenticate with 'agent' role but get 403
when accessing /api/v1/agent/commands/report endpoint.

Root Cause:
- Agent authentication (f_agent.rs) creates pseudo-user with role 'agent'
- Earlier migration (20251222160220) added agent permissions
- However, permissions may be missing on remote server

Solution:
- Create idempotent migration ensuring agent role has necessary permissions
- Grant 'agent' role access to:
  * POST /api/v1/agent/commands/report (command reporting)
  * GET /api/v1/agent/commands/wait/:deployment_hash (command polling)
- Ensure agent role inherits from group_anonymous

This allows Status Panel agents to report command results without
requiring per-agent Casbin rules, leveraging Vault token management
for authentication.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

…fig settings

Feature performance improvements