[Admin][API] Errors, Trace & Ops queue + MCP audit surfacing #33

[Admin][API] Errors, Trace & Ops queue + MCP audit surfacing

Why

PAGS already has rich observability tables that no operator view exposes cross-user: error_log (0034), agent_events (unified trace, 0038, behind /trace + MCP agent_trace), and the MCP audit log. Operators need an "is anything on fire?" surface like FGS's Ops page.

Scope

• GET /v1/admin/errors — cross-user error_log feed (paginated, filter by source/level/since/user). (errors.ts already supports scope=all for admins — formalize/reuse it under /v1/admin.)
• GET /v1/admin/events — cross-user agent_events trace (filter by trace_id/source/level/instance) for deep debugging.
• GET /v1/admin/ops — an ops queue: stuck/failed coding sessions & workflows (JobApply/CodingSession), instances with a runtime that registered but is not live, agents in error state, users with no API key, recent error spikes.
• GET /v1/admin/mcp-audit — surface the existing MCP audit log (who called which tool, scope, allow/deny).

Acceptance criteria

• Errors + events feeds paginate and filter; admin-only.
• Ops queue flags stuck/failed sessions & workflows and no-key users, computed live.
• MCP audit is queryable by user/tool/time.
• Non-admin → 403; tests.

Relevant code

• migrations/0034_error_log.sql, 0038_agent_events.sql; routes/errors.ts (existing scope=all), MCP audit (mcp_audit_log, workers/mcp/)
• Workflow state: workflows/job-apply.ts, workflows/coding-session.ts; coding_sessions, instance_runtime_nodes

References

• FGS Ops page + /api/errors (fgs/admin/), FAS /v1/admin/agent-errors (content-admin.ts).

Part of the PAGS Admin Portal epic. Depends on Foundation.