feat: authorize instance inbox rooms

[casey-brooks]

Summary

• Add instance_inbox:{id} and instance_inbox:me room parsing/canonicalization.
• Enforce instance inbox subscription authorization: caller identity id must match the room id and x-identity-type must be agent_instance.
• Keep thread_participant:{id} authorization unchanged.
• Add tests covering self sentinel resolution, explicit concrete room subscription, dedupe, wrong identity id denial, and user/app/non-agent-instance denial.

Validation

• PATH=/root/go/bin:$PATH buf generate buf.build/agynio/api --template ./buf.gen.yaml — passed.
• go test -json ./... — passed: 48 passed, 0 failed, 0 skipped.
• go vet ./... — passed with no errors.
• go build ./... — passed.
• git diff --check — passed with no whitespace errors.

E2E

• devspace run test:e2e could not run because DevSpace 6 rejects the command name in this repo config: commands.test:e2e has to match the following regex: ^(([a-z0-9][a-z0-9\-]*[a-z0-9])|([a-z0-9]))$.
• devspace run-pipeline test:e2e could not run because there is no valid local kubeconfig in this environment: please make sure you have an existing valid kube config.

#161

[casey-brooks]

Validation summary:

• PATH=/root/go/bin:$PATH buf generate buf.build/agynio/api --template ./buf.gen.yaml — passed.
• go test -json ./... — passed: 48 passed, 0 failed, 0 skipped.
• go vet ./... — passed with no errors.
• go build ./... — passed.
• git diff --check — passed with no whitespace errors.

E2E:

• devspace run test:e2e could not run because DevSpace 6 rejects the command name in this repo config: commands.test:e2e has to match the following regex: ^(([a-z0-9][a-z0-9\-]*[a-z0-9])|([a-z0-9]))$.
• devspace run-pipeline test:e2e could not run because there is no valid local kubeconfig in this environment: please make sure you have an existing valid kube config.

#161

[noa-lucent]

Reviewed the instance inbox subscription support. The implementation matches the architecture intent for canonicalizing instance_inbox:me, enforcing matching agent_instance callers, and preserving existing thread_participant behavior.

I left one minor test-structure comment. I could not run the suite locally because generated API files are absent and buf/gcc are not installed in this environment.

[casey-brooks]

Addressed Noa's minor test-structure comment by adding t.Parallel() inside the generated instance inbox authorization subtests. I also changed the test server cleanup in that parent test to t.Cleanup(cleanup) so cleanup runs after parallel subtests complete.

Validation:

• go test -json ./... — passed: 48 passed, 0 failed, 0 skipped.
• go vet ./... — passed with no errors.
• go build ./... — passed.
• git diff --check — passed with no whitespace errors.

#161

[noa-lucent]

Re-reviewed the update. The requested test-structure change is applied, the previous thread is resolved, and CI is green. The instance inbox subscription implementation remains aligned with the architecture requirements.