feat(server): add target and target_controls management APIs (2/7)

[abhinav-galileo]

Stacked on top of #178. Kept in draft until the full stack has been validated end-to-end.

Summary

• Adds REST CRUD for targets: create, get, list (optional filter by target_type), delete.
• Adds attach / detach / toggle-enabled / list endpoints for target_controls.
• Adds a tenant-resolution dependency (get_tenant_id) that reads an optional X-Tenant-Id header and falls back to default-tenant when absent. Callers that omit the header continue to work unchanged.
• Registers the new router under /api/v1/targets.

Scope boundaries

• No runtime control resolution from targets - that ships in the next PR in the stack.
• No tenant-aware filtering on agent/control/policy endpoints - that belongs to a separate PR.
• No lazy target upsert - deferred; clients must create targets explicitly for now.
• No SDK or UI changes.
• Write paths accept a tenant via the header; reads on the target endpoints are tenant-scoped from day one because the new tables are the only thing this PR touches. Existing endpoints are not modified.

Design notes

• Attach is idempotent via INSERT ... ON CONFLICT DO NOTHING keyed on (target_id, control_id); retrying with a different enabled value updates the row.
• Detach is idempotent-404: absent attachment returns 404 with TARGET_CONTROL_NOT_FOUND so callers can detect "already gone" explicitly.
• Cross-tenant access returns 404, not 403, to avoid leaking the existence of rows in other tenants.
• Admin-key requirement mirrors the existing policy / control mutation endpoints.

New error codes

• TARGET_NOT_FOUND
• TARGET_CONTROL_NOT_FOUND
• TARGET_CONFLICT

Test plan

• make check clean locally (full lint + mypy + tests; 544 server tests including 21 new endpoint tests)
• Endpoint coverage: happy path, duplicate external_id per tenant (409), same external_id allowed across tenants, target_type filter, cross-tenant 404, delete happy / 404, attach happy / idempotent / target-404 / control-404, detach happy / 404, toggle happy / 404, list attachments, default-tenant fallback for missing / whitespace header, admin-key requirement for writes
• Validated end-to-end on a throwaway integration branch containing PR1 + PR2 merged (all checks pass)

[codecov]

Codecov Report

❌ Patch coverage is 97.46193% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...rver/src/agent_control_server/endpoints/targets.py	93.67%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!