feat(#93): implement agent spawn via federation

Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.

Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)

Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
  CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification

Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts

Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)

Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed

Refs #93

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/4-api/4-crud-endpoints/README.md

@@ -5,6 +5,7 @@ Complete reference for Tasks, Events, and Projects API endpoints.
 ## Overview
 
 All CRUD endpoints follow standard REST conventions and require authentication. They support:
+
 - Full CRUD operations (Create, Read, Update, Delete)
 - Workspace-scoped isolation
 - Pagination and filtering
@@ -39,6 +40,7 @@ GET /api/tasks?status=IN_PROGRESS&page=1&limit=20
 ```
 
 **Query Parameters:**
+
 - `workspaceId` (UUID, required) — Workspace ID
 - `status` (enum, optional) — `NOT_STARTED`, `IN_PROGRESS`, `PAUSED`, `COMPLETED`, `ARCHIVED`
 - `priority` (enum, optional) — `LOW`, `MEDIUM`, `HIGH`
@@ -51,6 +53,7 @@ GET /api/tasks?status=IN_PROGRESS&page=1&limit=20
 - `limit` (integer, optional) — Items per page (default: 50, max: 100)
 
 **Response:**
+
 ```json
 {
   "data": [
@@ -122,6 +125,7 @@ Content-Type: application/json
 ```
 
 **Fields:**
+
 - `title` (string, required, 1-255 chars) — Task title
 - `description` (string, optional, max 10000 chars) — Detailed description
 - `status` (enum, optional) — Default: `NOT_STARTED`
@@ -153,6 +157,7 @@ All fields are optional for partial updates. Setting `status` to `COMPLETED` aut
 **Response (200):** Updated task object
 
 **Activity Logs:**
+
 - `UPDATED` — Always logged
 - `COMPLETED` — Logged when status changes to `COMPLETED`
 - `ASSIGNED` — Logged when `assigneeId` changes
@@ -190,6 +195,7 @@ GET /api/events?startFrom=2026-02-01&startTo=2026-02-28
 ```
 
 **Query Parameters:**
+
 - `workspaceId` (UUID, required) — Workspace ID
 - `projectId` (UUID, optional) — Filter by project
 - `startFrom` (ISO 8601, optional) — Events starting after this date
@@ -199,6 +205,7 @@ GET /api/events?startFrom=2026-02-01&startTo=2026-02-28
 - `limit` (integer, optional) — Items per page
 
 **Response:**
+
 ```json
 {
   "data": [
@@ -254,6 +261,7 @@ Content-Type: application/json
 ```
 
 **Fields:**
+
 - `title` (string, required, 1-255 chars) — Event title
 - `description` (string, optional, max 10000 chars) — Description
 - `startTime` (ISO 8601, required) — Event start time
@@ -304,6 +312,7 @@ GET /api/projects?status=ACTIVE
 ```
 
 **Query Parameters:**
+
 - `workspaceId` (UUID, required) — Workspace ID
 - `status` (enum, optional) — `PLANNING`, `ACTIVE`, `PAUSED`, `COMPLETED`, `ARCHIVED`
 - `startDateFrom` (ISO 8601, optional) — Projects starting after this date
@@ -312,6 +321,7 @@ GET /api/projects?status=ACTIVE
 - `limit` (integer, optional) — Items per page
 
 **Response:**
+
 ```json
 {
   "data": [
@@ -374,6 +384,7 @@ Content-Type: application/json
 ```
 
 **Fields:**
+
 - `name` (string, required, 1-255 chars) — Project name
 - `description` (string, optional, max 10000 chars) — Description
 - `status` (enum, optional) — Default: `PLANNING`
@@ -450,10 +461,7 @@ Validation errors in request body.
 ```json
 {
   "statusCode": 422,
-  "message": [
-    "title must not be empty",
-    "priority must be a valid TaskPriority"
-  ],
+  "message": ["title must not be empty", "priority must be a valid TaskPriority"],
   "error": "Unprocessable Entity"
 }
 ```