feat(v5): add server reconciliation and canvas APIs

Split V5 dashboard behavior into domain controllers and policies,
add agent token rotation/revocation, status reconciliation jobs,
ingress firewall syncing, and canvas connection APIs.

Add migrations for V5 status tracking, server capabilities, resource
connection aliases, and revoked agent tokens.

app/Exceptions/Handler.php

@@ -69,8 +69,9 @@ class Handler extends ExceptionHandler
      */
     public function render($request, Throwable $e)
     {
-        // Handle authorization exceptions for API routes
-        if ($e instanceof AuthorizationException) {
+        // Handle authorization exceptions for API routes. Exceptions carrying
+        // an explicit status (e.g. denyAsNotFound) keep it via parent::render.
+        if ($e instanceof AuthorizationException && ! $e->hasStatus()) {
             if ($request->is('api/*') || $request->expectsJson()) {
                 if ($request->is('api/*')) {
                     auditLog('api.auth.policy_denied', [