fix(agents): authenticate monitoring with persisted Token Spy credentials

[tang-vu]

Summary

Read the generated key when explicit configuration is absent, respecting explicit-key precedence and live key-file rotation.

Reconstructed only the reviewed #7212 scope on current upstream main b4f015a921c59eeb20317c5f48adf2dfb43b1430. Local candidate 9486919d282aff55c6195b722456477d720ec25f; previous published head 7f1ced02c369a90bc7230151c542b4b2845062fd is retained locally under refs/archive/ods-20261004/pr-7212. No behavioral changes were added during reconstruction; current-main changes outside this scope are preserved.

Issue association: Closes #7301.

AI Assistance

The human contributor and Codex collaborated on this PR. The contributor provided project direction, scope decisions and environment setup; Codex assisted with analysis, implementation or reconstruction, tests, review and PR preparation. The validation commands were executed by Codex, with results and limitations documented in this PR. The human contributor remains responsible for the final changes and validation claims. Maintainer review and applicable release gates remain required before merge. Earlier independent AI review receipts apply only to their recorded heads; current-candidate validation is identified separately in this PR.

Release Lane

• Mainline change targeting main

Changed Surface

• Dashboard API / host agent

Risk And Validation

• Risk level: High

• git diff --check

• Focused tests

• Commit identity gate against exact current-main base/candidate

4 real local HTTP/file tests passed. Current-main red: 3 failed, 1 explicit-key control passed.

The focused results were run on the exact candidate file tree before committing; the commit only recorded that tested tree. Original-head/full native and combined integration receipts remain archived, and are inherited evidence rather than fresh install or new-head hosted CI results.

CI execution: dashboard.yml discovers test_agent_monitor_persisted_key.py.

Operational Change Check

• Operational validation intentionally deferred: full fresh install, live model/GPU, Portal, hardware/release fleet and platform-specific lanes not explicitly exercised above. Root's separate current-main installation is not yet candidate validation.

Notes For Reviewers

Path matches Token Spy producer and shared Compose data mount. Full installed Token Spy service is unverified.

Rollback: revert this scope; preserve existing recovery receipts and configured data. Local native tests and green original-head CI do not replace human review or deployed-runtime gates.

CI follow-up

The new mypy ratchet found one heterogeneous test-state inference error. TypedDict now declares the key and observed authorization list; production code is unchanged. Four behavioral tests, changed-file mypy 2.4.0 and Ruff passed. The 464-error existing baseline is unchanged.

[Lightheartdevs]

Thanks for the careful work. Every installer (Linux, macOS, Windows) writes TOKEN_SPY_API_KEY into .env, and Compose passes it to dashboard-api. Token Spy only writes its key file when its own env var is empty, and in that state the LiteLLM and model-router producers are off too, so this fallback wouldn't bring any data back. No install reaches that state, so we're closing it.