feat(#93): implement agent spawn via federation

Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.

Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)

Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
  CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification

Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts

Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)

Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed

Refs #93

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/activity/activity.controller.spec.ts

@@ -152,10 +152,7 @@ describe("ActivityController", () => {
       const result = await controller.findOne("activity-123", mockWorkspaceId);
 
       expect(result).toEqual(mockActivity);
-      expect(mockActivityService.findOne).toHaveBeenCalledWith(
-        "activity-123",
-        "workspace-123"
-      );
+      expect(mockActivityService.findOne).toHaveBeenCalledWith("activity-123", "workspace-123");
     });
 
     it("should return null if activity not found", async () => {
@@ -213,11 +210,7 @@ describe("ActivityController", () => {
     it("should return audit trail for a task using authenticated user's workspaceId", async () => {
       mockActivityService.getAuditTrail.mockResolvedValue(mockAuditTrail);
 
-      const result = await controller.getAuditTrail(
-        EntityType.TASK,
-        "task-123",
-        mockWorkspaceId
-      );
+      const result = await controller.getAuditTrail(EntityType.TASK, "task-123", mockWorkspaceId);
 
       expect(result).toEqual(mockAuditTrail);
       expect(mockActivityService.getAuditTrail).toHaveBeenCalledWith(
@@ -248,11 +241,7 @@ describe("ActivityController", () => {
 
       mockActivityService.getAuditTrail.mockResolvedValue(eventAuditTrail);
 
-      const result = await controller.getAuditTrail(
-        EntityType.EVENT,
-        "event-123",
-        mockWorkspaceId
-      );
+      const result = await controller.getAuditTrail(EntityType.EVENT, "event-123", mockWorkspaceId);
 
       expect(result).toEqual(eventAuditTrail);
       expect(mockActivityService.getAuditTrail).toHaveBeenCalledWith(
@@ -312,11 +301,7 @@ describe("ActivityController", () => {
     it("should return empty array if workspaceId is missing (service handles gracefully)", async () => {
       mockActivityService.getAuditTrail.mockResolvedValue([]);
 
-      const result = await controller.getAuditTrail(
-        EntityType.TASK,
-        "task-123",
-        undefined as any
-      );
+      const result = await controller.getAuditTrail(EntityType.TASK, "task-123", undefined as any);
 
       expect(result).toEqual([]);
       expect(mockActivityService.getAuditTrail).toHaveBeenCalledWith(

apps/api/src/activity/interceptors/activity-logging.interceptor.spec.ts

@@ -25,9 +25,7 @@ describe("ActivityLoggingInterceptor", () => {
       ],
     }).compile();
 
-    interceptor = module.get<ActivityLoggingInterceptor>(
-      ActivityLoggingInterceptor
-    );
+    interceptor = module.get<ActivityLoggingInterceptor>(ActivityLoggingInterceptor);
     activityService = module.get<ActivityService>(ActivityService);
 
     vi.clearAllMocks();
@@ -324,9 +322,7 @@ describe("ActivityLoggingInterceptor", () => {
       const context = createMockExecutionContext("POST", {}, {}, user);
       const next = createMockCallHandler({ id: "test-123" });
 
-      mockActivityService.logActivity.mockRejectedValue(
-        new Error("Logging failed")
-      );
+      mockActivityService.logActivity.mockRejectedValue(new Error("Logging failed"));
 
       await new Promise<void>((resolve) => {
         interceptor.intercept(context, next).subscribe(() => {
@@ -727,9 +723,7 @@ describe("ActivityLoggingInterceptor", () => {
           expect(logCall.details.data.settings.apiKey).toBe("[REDACTED]");
           expect(logCall.details.data.settings.public).toBe("visible_data");
           expect(logCall.details.data.settings.auth.token).toBe("[REDACTED]");
-          expect(logCall.details.data.settings.auth.refreshToken).toBe(
-            "[REDACTED]"
-          );
+          expect(logCall.details.data.settings.auth.refreshToken).toBe("[REDACTED]");
           resolve();
         });
       });