add operator issue reports for endpoint agent

Operators had no way to flag a problem PC from the tray. This adds a report path: the tray captures a reason, free-text note, and optional screenshot and the agent uploads it on the collector token to a new operatorreports table linked to the asset. Ships the endpoints 0009 migration so the table exists before the code queries it; the running DB had drifted behind the code and returned HTTP 500 on upload.

tests/test_core/test_authz.py

@@ -94,7 +94,15 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # kill switch. Enqueue (WebUI -> operator) IS permission-gated
                     # on endpoints.command and IS swept. Contract in
                     # plugins/endpoints/AGENT-CONTRACT.md section 7.
-                    'endpoints.report_command_result'}
+                    'endpoints.report_command_result',
+                    # Agent-facing operator issue report upload. Authenticated by
+                    # the endpoints collector API key (same shape as the exempt
+                    # collector blueprint), not JWT+role: the tray hands the
+                    # screenshot and note to the service, which uploads on the
+                    # collector key it already holds. The human-facing read and
+                    # image-serve routes ARE permission-gated on endpoints.view
+                    # and ARE swept.
+                    'endpoints.upload_operator_report'}
 
 
 @pytest.fixture(autouse=True)