feat(v5): add server reconciliation and canvas APIs

Split V5 dashboard behavior into domain controllers and policies,
add agent token rotation/revocation, status reconciliation jobs,
ingress firewall syncing, and canvas connection APIs.

Add migrations for V5 status tracking, server capabilities, resource
connection aliases, and revoked agent tokens.

app/Http/Controllers/Api/Internal/FluxResourceStatusController.php

@@ -12,9 +12,7 @@ class FluxResourceStatusController extends Controller
 {
     public function __invoke(Request $request): JsonResponse
     {
-        $token = config('flux.laravel_api_token');
-
-        if (! is_string($token) || $token === '' || ! hash_equals($token, (string) $request->bearerToken())) {
+        if (! $this->authorizedBearer($request)) {
             abort(401);
         }
 
@@ -40,6 +38,7 @@ class FluxResourceStatusController extends Controller
             'state' => ['required_without:status', 'string', 'max:64'],
             'status_message' => ['nullable', 'string', 'max:1000'],
             'message' => ['nullable', 'string', 'max:1000'],
+            'observed_at' => ['nullable', 'string', 'date'],
         ])->validate();
 
         $resource = ApplyFluxResourceStatusUpdate::run($validated);
@@ -60,4 +59,53 @@ class FluxResourceStatusController extends Controller
             'message' => 'Resource status updated.',
         ]);
     }
+
+    /**
+     * Constant-time match the presented bearer token against every accepted
+     * inbound token. Accepting an array (config('flux.laravel_api_tokens'),
+     * falling back to the single config('flux.laravel_api_token')) lets an
+     * operator rotate by serving old+new tokens simultaneously.
+     *
+     * SECURITY: this is still a shared global secret — every flux instance
+     * presents the same token, so it cannot be scoped or revoked per-flux, and
+     * a leak forces a fleet-wide rotation. The target design is per-flux,
+     * individually rotatable tokens; until then the array support above is the
+     * mitigation that makes rotation possible without downtime.
+     */
+    private function authorizedBearer(Request $request): bool
+    {
+        $presented = (string) $request->bearerToken();
+
+        if ($presented === '') {
+            return false;
+        }
+
+        foreach ($this->acceptedTokens() as $token) {
+            if (hash_equals($token, $presented)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function acceptedTokens(): array
+    {
+        $tokens = config('flux.laravel_api_tokens', []);
+        $tokens = is_array($tokens) ? $tokens : [];
+
+        $single = config('flux.laravel_api_token');
+
+        if (is_string($single) && $single !== '') {
+            $tokens[] = $single;
+        }
+
+        return array_values(array_filter(
+            array_map(fn ($token): string => is_string($token) ? $token : '', $tokens),
+            fn (string $token): bool => $token !== ''
+        ));
+    }
 }