fix(api): use event-scoped route registration

Routes must go through $event->routes() so they only load for API
requests, not globally. LifecycleEventProvider adds /api prefix,
so Go client sets BaseURL to .../api.

Co-Authored-By: Virgil <virgil@lethean.io>

Boot.php

@@ -127,19 +127,18 @@ class Boot extends ServiceProvider
      * Handle API routes registration event.
      *
      * Registers REST API endpoints for go-agentic Client consumption.
-     * Routes are prefixed with /api by the API middleware group.
+     * LifecycleEventProvider wraps with 'api' middleware + '/api' prefix,
+     * so routes end up at /api/v1/*. Go client sets BaseURL to .../api.
      */
     public function onApiRoutes(ApiRoutesRegistering $event): void
     {
         // Register agent API auth middleware alias
         $event->middleware('agent.auth', Middleware\AgentApiAuth::class);
 
-        // Agent API routes are registered at /v1/* (no /api prefix)
-        // because the go-agentic Client uses BaseURL + "/v1/plans" directly.
-        // We register here but with our own Route group to avoid the
-        // automatic /api prefix from LifecycleEventProvider.
-        \Illuminate\Support\Facades\Route::middleware('api')
-            ->group(__DIR__.'/Routes/api.php');
+        // Scoped via event — only loaded for API requests
+        if (file_exists(__DIR__.'/Routes/api.php')) {
+            $event->routes(fn () => require __DIR__.'/Routes/api.php');
+        }
     }
 
     /**

Routes/api.php

@@ -14,7 +14,7 @@ use Illuminate\Support\Facades\Route;
 | REST endpoints for the go-agentic Client (dispatch watch).
 | Protected by AgentApiAuth middleware with Bearer token.
 |
-| Routes at /v1/* (no /api prefix — Go client uses BaseURL + "/v1/...")
+| Routes at /api/v1/* (Go client sets BaseURL to .../api)
 |
 */