feat(server): target-bearing runtime resolution (3/7)

[abhinav-galileo]

Stacked on top of #180. Kept in draft until the full stack has been validated end-to-end.

Summary

• Extends EvaluationRequest with optional target_type and target_id (both or neither; validated by a model validator).
• Resolves the internal target row from (tenant_id, target_type, external_id) when supplied.
• Merges target_controls into the effective runtime control set when a target is present.
• Requests that omit target fields use the classic agent + policy path unchanged.

Resolution semantics

• Effective control set is union(direct_agent, policy_derived, enabled_target_controls).
• UNION deduplicates by control_id; agent/policy rows effectively mask target rows when the same control appears from multiple sources (agent-level attachment takes precedence over target-level state).
• target_controls.enabled=false hides the control from the effective set only when target is the sole source; an agent/policy attachment for the same control still activates it.
• Unknown target in a target-bearing request returns 404 TARGET_NOT_FOUND. Lazy upsert is explicitly deferred to a later PR.

Scope boundaries

• Hot-path change: this PR is intentionally kept small and isolated so the diff that touches evaluation is easy to review and bisect.
• No schema migrations (done in the PR at the bottom of the stack).
• No management API changes (done in the previous PR).
• No SDK behavior changes. The SDK's mock expectation was updated because the shared EvaluationRequest model now serializes target_type / target_id as null when unset; this is a test-fixture adjustment, not a behavior change.

Performance notes

• No-target path: identical SQL as before (two-way UNION of agent+policy).
• Target path: three-way UNION with a single indexed lookup on (target_id, enabled).
• Target resolution is a single indexed hit on the new (tenant_id, target_type, external_id) unique constraint.

Test plan

• make check clean locally (1490 tests across packages; 553 server including 9 new target-resolution tests)
• New test coverage: target control enabled contributes, target control disabled hidden, no-target regression, agent mask beats target disable, dedup when same control in agent + target, unknown target returns 404, cross-tenant target resolution 404, only target_type fails 422, only target_id fails 422
• Validated on the integration branch with PR1 + PR2 + PR3 merged (all checks pass)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!