feat(agent): add durable existing-agent credential transitions

backend/app/identity.py

@@ -700,6 +700,7 @@ def required_page_permission(path: str) -> str:
 def machine_agent_request(path: str) -> bool:
     exact = {
         "/api/agent/enroll",
+        "/api/agent/credential-transition",
         "/api/agent/checkin",
         "/api/agent/config",
         "/api/agent/known-miners",
@@ -787,6 +788,8 @@ def required_api_permission(method: str, path: str) -> str | None:
         return "agents.view" if method == "GET" else "agents.manage"
     if path == "/api/agent-enrollments/windows-package":
         return "agents.manage"
+    if path == "/api/agent-credential-transitions":
+        return "agents.manage"
     if repair_parts_request(path):
         return "repairs.read" if method == "GET" else "repairs.parts.manage"
     if path.startswith("/api/admin/"):