fix(webapp): let the agent read a queue's own row, not only its metrics

Metrics authorize as a query read; paused, depth and limit live on the queue row, which is a queues read the agent's token did not carry — so a live lookup 403'd and read as a missing queue.

Author: kathiekiwi

apps/webapp/app/services/dashboardAgent.server.ts

@@ -20,6 +20,9 @@ const DASHBOARD_AGENT_UAT_CAP = [
   "read:environments",
   "read:errors",
   "read:query",
+  // Queue metrics ride on `read:query`, but a queue's own row — paused, depth, limit —
+  // is a `queues` read, and without it the agent can only see the metrics window.
+  "read:queues",
 ];
 
 // Minted fresh on every turn (the `in` proxy injects it), so the lifetime only

apps/webapp/test/dashboardAgentDelegatedScopeCeiling.test.ts

@@ -58,6 +58,16 @@ it("still hands over the reads the cap does carry", async () => {
   expect(clamped.scopes).toEqual(["read:runs"]);
 });
 
+it("can read a queue's own row, not just its metrics", async () => {
+  // Queue metrics authorize as a `query` read, but `paused` / depth / limit live on the
+  // queue row itself — a `queues` read. Without it the agent sees an empty window and
+  // says the queue does not exist.
+  const { ability } = await abilityFor(["read:query", "read:queues"]);
+
+  expect(ability.can("read", { type: "queues" })).toBe(true);
+  expect(ability.can("read", { type: "query", id: "queue_metrics" })).toBe(true);
+});
+
 it("refuses a write the cap forbids even when the user's role allows it", async () => {
   // The cloud path builds the ability from the user's role, not from the token's cap —
   // so the role alone would hand a read-only agent token a write JWT.