feat(#93): implement agent spawn via federation

Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.

Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)

Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
  CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification

Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts

Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)

Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed

Refs #93

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docs/scratchpads/85-connect-disconnect-protocol.md

@@ -13,6 +13,7 @@ Implement the connection handshake protocol for federation, building on the Inst
 ## Context
 
 Issue #84 provides the foundation:
+
 - `Instance` model with keypair for signing
 - `FederationConnection` model with status enum (PENDING, ACTIVE, SUSPENDED, DISCONNECTED)
 - `FederationService` with identity management
@@ -114,6 +115,7 @@ Extend `FederationController` with:
 ### 7. Testing Strategy
 
 **Unit Tests** (TDD approach):
+
 - SignatureService.sign() creates valid signatures
 - SignatureService.verify() validates signatures correctly
 - SignatureService.verify() rejects invalid signatures
@@ -124,6 +126,7 @@ Extend `FederationController` with:
 - Timestamp validation rejects old requests (>5 min)
 
 **Integration Tests**:
+
 - POST /connections/initiate creates connection and calls remote
 - POST /incoming/connect validates signature and creates connection
 - POST /connections/:id/accept updates status correctly
@@ -135,18 +138,18 @@ Extend `FederationController` with:
 ## Progress
 
 - [x] Create scratchpad
-- [ ] Create connection.types.ts with protocol types
-- [ ] Write tests for SignatureService
-- [ ] Implement SignatureService (sign, verify)
-- [ ] Write tests for ConnectionService
-- [ ] Implement ConnectionService
-- [ ] Write tests for connection API endpoints
-- [ ] Implement connection API endpoints
-- [ ] Update FederationModule with new providers
-- [ ] Verify all tests pass
-- [ ] Verify type checking passes
-- [ ] Verify test coverage ≥85%
-- [ ] Commit changes
+- [x] Create connection.types.ts with protocol types
+- [x] Write tests for SignatureService (18 tests)
+- [x] Implement SignatureService (sign, verify, validateTimestamp)
+- [x] Write tests for ConnectionService (20 tests)
+- [x] Implement ConnectionService (all 8 methods)
+- [x] Write tests for connection API endpoints (13 tests)
+- [x] Implement connection API endpoints (7 endpoints)
+- [x] Update FederationModule with new providers
+- [x] Verify all tests pass (70/70 passing)
+- [x] Verify type checking passes
+- [x] Verify test coverage ≥85% (100% coverage on new code)
+- [x] Commit changes (commit fc39190)
 
 ## Testing Plan