Add endpoint software delivery: run_script and update_app push

Adds the two delivery actions to the endpoints command allowlist, each gated on a new endpoints.deploy permission ON TOP OF endpoints.command so pushing software is a heavier grant than a routine toggle. Enqueue validates update_app appversionid ownership and installer presence before queueing. New collector-authenticated download routes let the agent fetch installer packages and script bodies by digest rather than pre-staging them or sending bodies over the command wire. Wires the scriptsApi client, the siteagent generator routes, and a temporary dev-only Delivery test bench (view/route/nav) for exercising the path while the production UI is built.

frontend/src/api/index.js

@@ -687,6 +687,43 @@ export const applicationsApi = {
   }
 }
 
+// ShopDB-hosted script library. Backs run_script delivery: the agent fetches a
+// script body by digest with its collector credential and runs it in the
+// script's configured run context (system or user).
+export const scriptsApi = {
+  list(params = {}) {
+    return api.get('/scripts', { params })
+  },
+  listAll(params = {}) {
+    return fetchAllPages('/scripts', params)
+  },
+  get(id) {
+    return api.get(`/scripts/${id}`)
+  },
+  create(data) {
+    return api.post('/scripts', data)
+  },
+  update(id, data) {
+    return api.put(`/scripts/${id}`, data)
+  },
+  delete(id) {
+    return api.delete(`/scripts/${id}`)
+  },
+  // script-body upload; backend sets filename/sha256 to the stored payload.
+  uploadBody(id, file, onProgress) {
+    const form = new FormData()
+    form.append('file', file)
+    return api.post(`/scripts/${id}/body`, form, {
+      headers: { 'Content-Type': 'multipart/form-data' },
+      onUploadProgress: event => {
+        if (onProgress && event.total) {
+          onProgress(Math.round((event.loaded * 100) / event.total))
+        }
+      }
+    })
+  }
+}
+
 // Support Teams API (teams + nested contacts)
 export const supportteamsApi = {
   list(params = {}) {