feat(v5): add server reconciliation and canvas APIs

Split V5 dashboard behavior into domain controllers and policies,
add agent token rotation/revocation, status reconciliation jobs,
ingress firewall syncing, and canvas connection APIs.

Add migrations for V5 status tracking, server capabilities, resource
connection aliases, and revoked agent tokens.

app/Exceptions/Handler.php

@@ -69,8 +69,9 @@ class Handler extends ExceptionHandler
      */
     public function render($request, Throwable $e)
     {
-        // Handle authorization exceptions for API routes
-        if ($e instanceof AuthorizationException) {
+        // Handle authorization exceptions for API routes. Exceptions carrying
+        // an explicit status (e.g. denyAsNotFound) keep it via parent::render.
+        if ($e instanceof AuthorizationException && ! $e->hasStatus()) {
             if ($request->is('api/*') || $request->expectsJson()) {
                 if ($request->is('api/*')) {
                     auditLog('api.auth.policy_denied', [

app/Exceptions/V5/UnsupportedCooldVerb.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Exceptions\V5;
+
+use RuntimeException;
+
+/**
+ * The per-node coold agent does not implement the dispatched verb. Flux
+ * rejects these before they reach the node, so callers can degrade
+ * gracefully instead of treating the miss as an operational failure.
+ */
+class UnsupportedCooldVerb extends RuntimeException
+{
+    public function __construct(public readonly string $verb, string $message = '')
+    {
+        parent::__construct($message !== '' ? $message : "The node's coold agent does not support the {$verb} verb.");
+    }
+}