feat(#93): implement agent spawn via federation

Implements FED-010: Agent Spawn via Federation feature that enables
spawning and managing Claude agents on remote federated Mosaic Stack
instances via COMMAND message type.

Features:
- Federation agent command types (spawn, status, kill)
- FederationAgentService for handling agent operations
- Integration with orchestrator's agent spawner/lifecycle services
- API endpoints for spawning, querying status, and killing agents
- Full command routing through federation COMMAND infrastructure
- Comprehensive test coverage (12/12 tests passing)

Architecture:
- Hub → Spoke: Spawn agents on remote instances
- Command flow: FederationController → FederationAgentService →
  CommandService → Remote Orchestrator
- Response handling: Remote orchestrator returns agent status/results
- Security: Connection validation, signature verification

Files created:
- apps/api/src/federation/types/federation-agent.types.ts
- apps/api/src/federation/federation-agent.service.ts
- apps/api/src/federation/federation-agent.service.spec.ts

Files modified:
- apps/api/src/federation/command.service.ts (agent command routing)
- apps/api/src/federation/federation.controller.ts (agent endpoints)
- apps/api/src/federation/federation.module.ts (service registration)
- apps/orchestrator/src/api/agents/agents.controller.ts (status endpoint)
- apps/orchestrator/src/api/agents/agents.module.ts (lifecycle integration)

Testing:
- 12/12 tests passing for FederationAgentService
- All command service tests passing
- TypeScript compilation successful
- Linting passed

Refs #93

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/integration/docker/README.md

@@ -27,6 +27,7 @@ Tests for Traefik reverse proxy integration in bundled, upstream, and none modes
 ### Test Coverage
 
 #### Bundled Mode Tests
+
 - Traefik container starts with `traefik-bundled` profile
 - Traefik dashboard is accessible
 - Traefik API responds correctly
@@ -34,12 +35,14 @@ Tests for Traefik reverse proxy integration in bundled, upstream, and none modes
 - Routes are registered with Traefik
 
 #### Upstream Mode Tests
+
 - Bundled Traefik does not start
 - Services connect to external Traefik network
 - Services have labels for external discovery
 - Correct network configuration
 
 #### None Mode Tests
+
 - No Traefik container starts
 - Traefik labels are disabled
 - Direct port access works
@@ -64,17 +67,22 @@ test-docker:
 ### Troubleshooting
 
 #### Test cleanup issues
+
 If tests fail and leave containers running:
+
 ```bash
 docker compose -f docker-compose.test.yml down -v
 docker network rm traefik-public-test
 ```
 
 #### Permission denied
+
 Make sure the test script is executable:
+
 ```bash
 chmod +x traefik.test.sh
 ```
 
 #### Port conflicts
+
 Ensure ports 8080, 3000, 3001 are available before running tests.

tests/integration/vitest.config.ts

@@ -1,17 +1,17 @@
-import { defineConfig } from 'vitest/config';
+import { defineConfig } from "vitest/config";
 
 export default defineConfig({
   test: {
-    name: 'docker-integration',
-    include: ['**/*.test.ts'],
+    name: "docker-integration",
+    include: ["**/*.test.ts"],
     testTimeout: 120000, // 2 minutes for Docker operations
     hookTimeout: 120000,
     globals: true,
-    environment: 'node',
+    environment: "node",
     coverage: {
-      provider: 'v8',
-      reporter: ['text', 'json', 'html'],
-      include: ['tests/integration/**/*.ts'],
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      include: ["tests/integration/**/*.ts"],
     },
   },
 });