feat(portal): add agent extension config endpoints and block component

[sytone]

Closes #407 (Phase 3 of 3)

Changes

ConfigController.cs

Two new endpoints for per-agent extension config management:

• GET /api/config/agents/{agentId}/extensions/{extensionId}

  • Returns 200 with the raw JSON object stored under agents.{agentId}.extensions.{extensionId}
  • Returns 204 No Content if the agent exists but has no config for this extension
  • Returns 404 if the agent is not found or agentId == "defaults"
  • Reads from in-memory IOptionsMonitor first; falls back to disk via PlatformConfigWriter

• PUT /api/config/agents/{agentId}/extensions/{extensionId}

  • Writes the request body to agents.{agentId}.extensions.{extensionId} via PlatformConfigWriter.MutateAsync
  • Returns 200 on success, 404 if agent not found or agentId == "defaults"
  • Atomically updates the config file (existing agent properties preserved)

AgentExtensionConfigBlock.razor (new component)

Schema-driven collapsible block for per-agent extension config in the portal.
Intended to be embedded in AgentDetailPanel.razor (Phase 2, PR #494) for each loaded extension that declares a ConfigSchema.

Features:

• Hidden entirely when the extension has no Schema fields
• Collapsed by default; click header to expand
• Loads existing config from GET endpoint on expand
• Field types: string (text input), bool (checkbox), integer (text with int parse); sensitive: true fields use password input with lock badge
• Dirty tracking: Save button disabled when no changes; Reset restores original values
• Status message auto-dismisses after 4 seconds
• Error state shows retry button

Tests

• AgentExtensionConfigControllerTests (8 tests): GET 200/204/404, PUT 200/404, defaults guard, pre-existing integration test contamination avoided by using controller unit tests
• AgentExtensionConfigBlockTests (7 bunit tests): no-schema renders nothing, header with name, collapsed by default, expand shows fields, sensitive field password input, pre-populated from existing config, API error shows error text

[sytone]

CI: All checks passing (build-and-test, CodeQL, TruffleHog, patterns, deps)
Merge conflicts: Clean / MERGEABLE
Commit title: feat(portal): add agent extension config endpoints and block component ✅ conventional
Coverage: 8 controller unit tests (GET 200/204/404, PUT 200/404, defaults guard) + 7 bunit tests (no-schema renders nothing, header, collapsed default, expand shows fields, sensitive password input, pre-populated, error state). Happy and sad paths covered ✅
Spec completeness vs #407 Phase 3: GET/PUT /api/config/agents/{agentId}/extensions/{extensionId} implemented. AgentExtensionConfigBlock.razor schema-driven with dirty tracking, sensitive field masking, auto-dismiss status, and retry on error ✅

LGTM - all 3 phases of #407 now have PRs. Ready to merge.

[sytone]

CI: ✅ All checks passing
Merge: CLEAN — no conflicts
Commit title: feat(portal): add agent extension config endpoints and block component ✅ Conventional commit
Coverage: 8 controller + 7 bunit tests
Spec completeness: Closes #407 Phase 3 — GET/PUT extension config endpoints + collapsible schema-driven AgentExtensionConfigBlock component

LGTM — ready to merge.

[sytone]

Farnsworth Review — PR #495

CI: ✅ All checks passing
Merge conflicts: ✅ Clean (MERGEABLE)
Conventional commit title: ✅ feat(portal): add agent extension config endpoints and block component

Test coverage:

• ✅ 8 controller unit tests (GET/PUT extension config, 404/400 paths)
• ✅ 7 bunit tests (AgentExtensionConfigBlock renders, schema fields, collapsible)
• 1497 gateway + 344 blazor pass

Spec completeness vs #407 Phase 3: Satisfies the extension config block requirement. Schema-driven approach means no component changes needed when extension schemas evolve. Correct sub-issue of #407 decomposition.

LGTM. Ready to merge.

[sytone]

Closing as part of a planned hard-reset of the in-flight branch set so the new domain-model refactor can land on a clean trunk.

Audit verdict: keep

Rationale: Configuration-layer; orthogonal.

The new plan (in session state) reshapes core types: Citizen (User+Agent union), Vogen-generated value objects, ThreadId removed in favour of composite ChannelAddress, mark-not-delete compaction, centralised SessionContextProjector, single-path routing. Many in-flight branches touch contracts that are about to change — rebasing later would be more work than rebuilding on the new shape.

If this work is still wanted, refile as a new issue/PR against the post-refactor contracts.