Ingress: per-org agent tokens (ADR 0074 follow-up)

[brokk-ccl]

Goal

Replace sole reliance on shared BROKK_API_SECRET for Devin-class ingress with per-org agent tokens that can create cards only in that org's projects.

Context

• Contract today: docs/INGRESS.md — Bearer BROKK_API_SECRET.
• Endpoint: POST /ingress/cards in apps/api/src/routes/ingress.ts.
• Multi-tenant axis already exists (Logto → orgs → projects).

Implement

1. Schema: store hashed agent tokens scoped to orgId (or project allowlist), with label, createdAt, lastUsedAt, revokedAt.
2. Auth on /ingress/cards: accept Authorization: Bearer <agent_token> or staff BROKK_API_SECRET. Agent token must not access other orgs' projects.
3. Mint/revoke API (staff-only): e.g. POST /orgs/:orgId/agent-tokens, DELETE …/:id.
4. Update docs/INGRESS.md + .env.example notes.
5. Tests for auth matrix (secret ok, token ok, wrong org 403, revoked 401).

Out of scope

• OAuth user sessions, public signup, billing.

Acceptance

• Ingress with org agent token creates queued card only for that org's project.
• Cross-org projectId → 403.
• Docs describe both auth modes.
• pnpm --filter @brokk/api test covers the new cases.

Verify: ❌ failed

verify output

Scope: 17 of 19 workspace projects
packages/afl typecheck$ tsc --noEmit
packages/core typecheck$ tsc --noEmit
packages/repomap typecheck$ tsc --noEmit
packages/core typecheck: sh: 1: tsc: not found
packages/afl typecheck: sh: 1: tsc: not found
/home/brokk/work/worktrees/brokk__ingress-per-org-agent-tokens-adr-0074-follow-up-1dc45d91/packages/afl:
 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL  @brokk/afl@0.0.0 typecheck: `tsc --noEmit`
spawn ENOENT
 WARN   Local package.json exists, but node_modules missing, did you mean to install?
 WARN   Local package.json exists, but node_modules missing, did you mean to install?
packages/repomap typecheck: sh: 1: tsc: not found
 WARN   Local package.json exists, but node_modules missing, did you mean to install?


Command failed: pnpm -r --filter=!@brokk/web typecheck && pnpm --filter @brokk/afl test

E2E: ❌ failed · legacy-acceptance

e2e output

[e2e] check timed out after 120s

---

🔨 Forged by Brokk · task 49cea9d7-1c1f-4a00-b41b-d1b877f86e89