feat(#93): implement agent spawn via federation

Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.

Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)

Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
  CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification

Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts

Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)

Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed

Refs #93

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/federation/command.service.ts

@@ -5,6 +5,7 @@
  */
 
 import { Injectable, Logger } from "@nestjs/common";
+import { ModuleRef } from "@nestjs/core";
 import { HttpService } from "@nestjs/axios";
 import { randomUUID } from "crypto";
 import { firstValueFrom } from "rxjs";
@@ -26,7 +27,8 @@ export class CommandService {
     private readonly prisma: PrismaService,
     private readonly federationService: FederationService,
     private readonly signatureService: SignatureService,
-    private readonly httpService: HttpService
+    private readonly httpService: HttpService,
+    private readonly moduleRef: ModuleRef
   ) {}
 
   /**
@@ -158,15 +160,33 @@ export class CommandService {
       throw new Error(verificationResult.error ?? "Invalid signature");
     }
 
-    // Process command (placeholder - would delegate to actual command processor)
+    // Process command
     let responseData: unknown;
     let success = true;
     let errorMessage: string | undefined;
 
     try {
-      // TODO: Implement actual command processing
-      // For now, return a placeholder response
-      responseData = { message: "Command received and processed" };
+      // Route agent commands to FederationAgentService
+      if (commandMessage.commandType.startsWith("agent.")) {
+        // Import FederationAgentService dynamically to avoid circular dependency
+        const { FederationAgentService } = await import("./federation-agent.service");
+        const federationAgentService = this.moduleRef.get(FederationAgentService, {
+          strict: false,
+        });
+
+        const agentResponse = await federationAgentService.handleAgentCommand(
+          commandMessage.instanceId,
+          commandMessage.commandType,
+          commandMessage.payload
+        );
+
+        success = agentResponse.success;
+        responseData = agentResponse.data;
+        errorMessage = agentResponse.error;
+      } else {
+        // Other command types can be added here
+        responseData = { message: "Command received and processed" };
+      }
     } catch (error) {
       success = false;
       errorMessage = error instanceof Error ? error.message : "Command processing failed";