security(discovery): enforce Zone isolation and retire unsafe legacy writers

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

backend/app/identity.py

@@ -711,6 +711,7 @@ def machine_agent_request(path: str) -> bool:
         "/api/agent/commands/pending-disabled-old",
         "/api/agent/commands/result-disabled-old",
         "/api/agent/discoveries",
+        "/api/agent/discovery-target",
         "/api/agent/miner-enrichment",
         "/api/agent/miner-enrichment-v2",
         "/api/agent/miner-enrichment-v3",
@@ -826,6 +827,8 @@ def required_api_permission(method: str, path: str) -> str | None:
         return "repairs.complete"
     if method == "GET" and repair_timeline_request(path):
         return "repairs.read"
+    if method == "GET" and path in {"/api/agent/discoveries/summary", "/api/agent/status-summary"}:
+        return "agents.view"
     if method == "GET":
         if path.startswith("/api/system/"):
             return "system_health.view"