fix(security): operator-queue access control — scope items to accessible agents (#470)

[vybe]

Summary

• Fixes High-severity broken access control (pentest finding 3.1.3 Broken Access Control [User]): GET /api/operator-queue and related endpoints were returning items for all agents on the platform regardless of requester ownership
• All 6 operator-queue endpoints now enforce user-scoped filtering: list, stats, get, respond, cancel, and /agents/{name}
• Admin users retain full visibility (no regression)
• Unblocks the Letter of Attestation (A grade) from the security vendor

Changes

• src/backend/db/operator_queue.py — list_items() and get_stats() accept accessible_agent_names: Optional[Set[str]]; empty set short-circuits before SQL executes (prevents IN () syntax error); all 5 stats sub-queries apply the filter so by_agent never leaks foreign agent names
• src/backend/routers/operator_queue.py — _accessible_set() helper computes user's allowed agents via db.get_accessible_agent_names(); _assert_agent_accessible() raises 403 on unauthorized access; applied to all 6 endpoints
• src/backend/database.py — get_operator_queue_stats() passes **kwargs through to support the new param
• tests/test_operator_queue.py — 8 new tests in TestOperatorQueueAccessControl: non-admin list/get/respond/cancel/agents/stats isolation + admin regression

Test Plan

• All 42 existing tests pass, 3 skipped (no live pending items): pytest tests/test_operator_queue.py -v
• 8 new isolation tests pass: non-admin gets 403/filtered-list on all endpoints; admin sees everything
• Manual: non-admin user's list returns only their own agents' items; stats by_agent contains no foreign agents

Closes #470

Note: also includes a separate UI commit (feat(agents): overflow-visible avatar) that was an unrelated pre-existing working-tree change.

🤖 Generated with Claude Code