feat(agent): replace + delete endpoints for agent-tier sources

[miguelgfierro]

What it delivers

Two new agent-tier endpoints on /api/v1/agent/sources/{source_id}, both gated by X-Agent-Token with scope agent.sources:ingest and a mandatory Idempotency-Key:

• PUT — replaces a document in place by stable id. Delegates to the existing ReplaceSourceCommand -> IntakeService.replace path (same as the user-tier PUT): the intake pipeline re-runs against the new bytes and the chunks + dense vectors are replaced under the same source_id. content_base64 is required (URL fetch not supported, mirroring the user-tier PUT). Returns the updated SourceRecord (200); unknown ids within the tenant/workspace scope return 404.
• DELETE — removes a source via a new minimal removal path (RemoveSourceCommand -> IntakeService.remove): purges the BM25 rows + dense vectors (IndexService.remove_for_source), deletes the chunk rows and the source row within the tenant/workspace scope, records a source.removed audit entry, and publishes a SourceRemoved EDA event consistent with SourceIngested/SourceReplaced. Returns 204; unknown ids return 404. Object-store originals are not touched, and no user-tier DELETE is exposed.

Both routes replay-cache their responses under route-specific dedup scopes (agent.sources:replace / agent.sources:delete), so retries return the original response without re-dispatching — a retried DELETE does not surface a spurious 404.

Also included: regenerated OpenAPI snapshot, CHANGELOG entries under Unreleased, and unit tests covering happy paths, missing-key rejection, replay short-circuit, scope refusal, 404s, and the purge ordering (vectors are deleted before the chunk rows so external stores cannot leak embeddings).

Benefit

An external control-plane can now keep its work items fully synchronized in flycanon at the agent tier: documents can be updated in place (citations follow the new content instead of orphaning) and removed cleanly (no stale chunks or dangling vectors in the index), with safe retry semantics end to end.

Design notes

• Vector purge runs before chunk-row deletion because IndexService.remove_for_source resolves the chunk ids through the chunk repository; the ordering is pinned by a test.
• Removal is deliberately agent-tier only; the user-tier surface is unchanged.