Add endpoint software delivery: run_script and update_app push

Adds the two delivery actions to the endpoints command allowlist, each gated on a new endpoints.deploy permission ON TOP OF endpoints.command so pushing software is a heavier grant than a routine toggle. Enqueue validates update_app appversionid ownership and installer presence before queueing. New collector-authenticated download routes let the agent fetch installer packages and script bodies by digest rather than pre-staging them or sending bodies over the command wire. Wires the scriptsApi client, the siteagent generator routes, and a temporary dev-only Delivery test bench (view/route/nav) for exercising the path while the production UI is built.

plugins/endpoints/frontend/routes.js

@@ -17,6 +17,16 @@ export default [
     name: 'endpoints-agentkey-settings',
     component: () => import('./views/AgentKeySettings.vue'),
     meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
+  },
+  // TEMPORARY / DEV ONLY. A manual bench to exercise the update_app and
+  // run_script delivery path end to end while Cameron builds the real UI.
+  // Gated on endpoints.deploy inside the view; remove once the production
+  // delivery UI lands.
+  {
+    path: 'endpoints/delivery-test',
+    name: 'endpoints-delivery-test',
+    component: () => import('./views/DeliveryTestBench.vue'),
+    meta: { requiresAuth: true, plugin: 'endpoints' }
   }
 ]