…5406)

Phase 3d of the pod-SA → kc-agent refactor. The /ws/exec WebSocket now
runs under kc-agent using the user's own kubeconfig rather than the
backend pod ServiceAccount. The target cluster's apiserver enforces RBAC
natively against the caller's identity, so the SubjectAccessReview
workaround the backend handler had to simulate (#8120, #5406) is no
longer needed — the shell fails synchronously at stream-open time if
the user's kubeconfig doesn't permit pods/exec on the target pod.

Fixes #5406.

pkg/agent/server_exec.go (new file, ~520 lines):
  handleExec is the kc-agent side of the pod exec WebSocket. The flow
  mirrors the backend handler minus the pod-SA-specific layers:
    1. Token validation via the standard s.validateToken(r) path
       (Authorization header or ?token= query param fallback that
       kc-agent's /ws already uses) — no first-message JWT handshake.
    2. Gorilla WebSocket upgrade.
    3. Read the exec_init JSON frame (cluster/namespace/pod/container/
       command/tty/cols/rows).
    4. Resolve the clientset + REST config from the shared
       *k8s.MultiClusterClient (the user's kubeconfig).
    5. Build the SPDY exec stream and spin up ping ticker + read loop
       goroutines under a shared writeMu.
    6. Block on executor.StreamWithContext; on exit, drain the reader
       goroutine (#7048 / #7778 ordering preserved) and send the exit
       frame.

  What we kept from the backend handler because it's independent of
  the pod-SA problem:
    - The stdin drop telemetry (agentExecStdinDropCount +
      rate-limited WARN log on power-of-two session counts) from PR 7995.
    - The agentExecMaxStdinBytes frame cap (1 MiB).
    - The #7048 / #7778 ordering: drain reader before closing the
      resize queue channel to avoid send-on-closed panic.
    - Ping/pong keepalive so half-open TCP is detected within
      agentExecPongTimeout.
    - Terminal size queue for TTY resize events.
    - writeMu serializing every WriteMessage so stdout/stderr/ping/
      exit/error frames never race.

  What we dropped because kc-agent uses the user's kubeconfig:
    - First-message JWT auth handshake (authMessage type). Auth is on
      the HTTP upgrade now.
    - execAuthorizer interface + authorizePodExec + the four sentinel
      errors errExecAuthorizerUnavailable / errExecMissingUserSubject
      / errExecSARFailed / errExecRBACDenied. The whole SubjectAccess-
      Review dance was there to simulate the user's identity against
      the pod SA's clientset (#8120, #8137, #8139, #8140); kc-agent's
      clientset IS the user's identity, so the apiserver enforces
      natively.
    - Per-user execSessionsRegistry / registerExecSession /
      unregisterExecSession / CancelUserExecSessions. kc-agent is a
      per-user local process with no logout concept — if the user
      closes their browser tab the WebSocket closes, the read loop
      exits, and execCancel fires via defer. #6024's cross-session
      cleanup is no longer needed.

  Named constants instead of literals per the repo rule:
  agentExecMaxStdinBytes (1 MiB), agentExecPingInterval (30s),
  agentExecPongTimeout (45s), agentExecWriteDeadline (10s — explicit
  because gorilla unlike gofiber does not have an implicit write
  timeout), agentExecStdinBufferSize (32), agentExecResizeBufferSize
  (4), agentExecDefaultCols (80), agentExecDefaultRows (24).

pkg/agent/server.go:
  mux.HandleFunc("/ws/exec", s.handleExec) registered next to /ws with
  an explanatory comment.

pkg/api/handlers/exec.go + exec_test.go (deleted):
  The entire 791-line backend handler and its 395-line test file are
  gone. The architecture is cleaner now — there's one code path for
  exec, it runs against the user's identity, and the whole class of
  "who is the console SA and what can it impersonate" concerns is
  retired alongside the code.

pkg/api/handlers/auth.go:
  The Logout handler used to call CancelUserExecSessions (#6024) to
  tear down exec streams that were running as the pod SA when the
  user's JWT was revoked. kc-agent exec is per-user local, so there
  are no cross-session exec streams to cancel on logout. The SSE
  cancellation (#6029) stays; it's unrelated.

pkg/api/server.go:
  The backend /ws/exec route registration is gone. A comment at the
  same line points readers at pkg/agent/server_exec.go and
  web/src/hooks/useExecSession.ts for the replacement.

web/src/hooks/useExecSession.ts:
  The WebSocket URL is now LOCAL_AGENT_WS_URL.replace(/\/ws$/, '/ws/exec')
  instead of ${window.location.host}/ws/exec so the browser connects
  to the user's own kc-agent at 127.0.0.1:8585. The first-message
  auth send is removed (kc-agent validates on upgrade). STORAGE_KEY_TOKEN
  import dropped; LOCAL_AGENT_WS_URL added.

web/src/hooks/__tests__/useExecSession.test.ts (40/40 pass):
  Three assertion updates — sentMessages[0] is now exec_init (not
  auth), sentMessages[1] is no longer used. The "no auth token on
  connect" test is removed (that failure mode no longer exists on the
  frontend; kc-agent would 401 on upgrade instead, which the
  "constructor throwing" test already covers).

Refs #7993. Fixes #5406.

Signed-off-by: Andrew Anderson <[email protected]>