[Admin][API] Errors, Trace & Ops queue + MCP audit surfacing

[serge-ivo]

[Admin][API] Errors, Trace & Ops queue + MCP audit surfacing

Why

PAGS already has rich observability tables that no operator view exposes cross-user: error_log (0034), agent_events (unified trace, 0038, behind /trace + MCP agent_trace), and the MCP audit log. Operators need an "is anything on fire?" surface like FGS's Ops page.

Scope

• GET /v1/admin/errors — cross-user error_log feed (paginated, filter by source/level/since/user). (errors.ts already supports scope=all for admins — formalize/reuse it under /v1/admin.)
• GET /v1/admin/events — cross-user agent_events trace (filter by trace_id/source/level/instance) for deep debugging.
• GET /v1/admin/ops — an ops queue: stuck/failed coding sessions & workflows (JobApply/CodingSession), instances with a runtime that registered but is not live, agents in error state, users with no API key, recent error spikes.
• GET /v1/admin/mcp-audit — surface the existing MCP audit log (who called which tool, scope, allow/deny).

Acceptance criteria

• Errors + events feeds paginate and filter; admin-only.
• Ops queue flags stuck/failed sessions & workflows and no-key users, computed live.
• MCP audit is queryable by user/tool/time.
• Non-admin → 403; tests.

Relevant code

• migrations/0034_error_log.sql, 0038_agent_events.sql; routes/errors.ts (existing scope=all), MCP audit (mcp_audit_log, workers/mcp/)
• Workflow state: workflows/job-apply.ts, workflows/coding-session.ts; coding_sessions, instance_runtime_nodes

References

• FGS Ops page + /api/errors (fgs/admin/), FAS /v1/admin/agent-errors (content-admin.ts).

Part of the PAGS Admin Portal epic. Depends on Foundation.

[serge-ivo]

Closing as implemented on main. Evidence: admin errors API (/v1/admin/errors and /errors/summary), admin trace API (/v1/admin/trace/:instanceId), ops queue (/v1/admin/ops), and MCP audit API (/v1/admin/mcp-audit) are present under workers/api/src/routes; tests cover admin auth/errors, and the admin SPA has Errors, Ops, TraceView, and McpAudit pages.

[serge-ivo]

Implementation links: no associated PR was found; this landed direct on main in 9745b6a.