Separate operator and agent route surfaces

[Darkroom4364]

Summary

• Serve operator UI, API, and WebSocket routes from an explicit operator mux instead of the process global default mux.
• Keep agent polling routes listener-owned and return 404 for accidental agent polling calls on the operator API surface.
• Add a static same-origin operator command endpoint for the UI and remove the hard-coded 8080 command API call.
• Document route ownership, default operator/listener ports, and a command queueing smoke path.
• Add a focused test proving the operator API does not serve agent polling routes.

Verification

• go test ./... in server
• go vet ./... in server
• go build -o /private/tmp/microc2-server-issue75 ./cmd in server
• gofmt -l server
• node --check for server web JavaScript files
• bash -n for install.sh and agent/build.sh
• git diff --check
• npx foxguard latest diff against origin/dev: zero new findings

Closes #75

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fc0bfc92-1112-4ab3-8d40-922fe99bd896

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue/75-route-split

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}