perf(agentnetwork): resolve endpoints by indexed subdomain lookup

Reverse resolution -- hostname to owning account -- prefiltered candidates by
"strip the first label and treat the rest as a cluster address". For an
endpoint whose parent is a DNS zone that matches no cluster, the prefilter
found nothing and resolution failed for every zone-based tenant.

Both endpoint shapes put the account's label in the first DNS label, and the
label is now globally unique, so one indexed point lookup resolves either
shape. This replaces the prefilter outright rather than adding a fallback
scan, which matters because the lookup runs per request from the
authentication path. A label match is not sufficient on its own -- owning
"brave-otter" does not mean owning "brave-otter.example.com" -- so the
resolved row's endpoint is still compared against the requested hostname.

Only a not-found is translated to "no such endpoint"; a genuine store failure
surfaces, so a database outage cannot be mistaken for a miss.

management/server/store/sql_store_agentnetwork.go

@@ -334,6 +334,30 @@ func (s *SqlStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStr
 	return settings, nil
 }
 
+// GetAgentNetworkSettingsBySubdomain returns the settings row that owns the
+// given subdomain label. The label is globally unique (enforced by
+// idx_agent_network_settings_subdomain_unique), so at most one row can match,
+// which makes this an indexed point lookup rather than a scan.
+func (s *SqlStore) GetAgentNetworkSettingsBySubdomain(ctx context.Context, lockStrength LockingStrength, subdomain string) (*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings agentNetworkTypes.Settings
+	result := tx.Take(&settings, "subdomain = ?", subdomain)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "agent network settings for subdomain %s not found", subdomain)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network settings by subdomain from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by subdomain from store")
+	}
+
+	return &settings, nil
+}
+
 // SaveAgentNetworkSettings upserts the per-account Agent Network
 // settings row.
 func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {

management/server/store/store.go

@@ -361,6 +361,7 @@ type Store interface {
 	GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error)
 	GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error)
 	GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsBySubdomain(ctx context.Context, lockStrength LockingStrength, subdomain string) (*agentNetworkTypes.Settings, error)
 	SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error

management/server/store/store_mock.go

@@ -1716,6 +1716,21 @@ func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStren
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
 }
 
+// GetAgentNetworkSettingsBySubdomain mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsBySubdomain(ctx context.Context, lockStrength LockingStrength, subdomain string) (*types.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsBySubdomain", ctx, lockStrength, subdomain)
+	ret0, _ := ret[0].(*types.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsBySubdomain indicates an expected call of GetAgentNetworkSettingsBySubdomain.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsBySubdomain(ctx, lockStrength, subdomain interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsBySubdomain", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsBySubdomain), ctx, lockStrength, subdomain)
+}
+
 // GetAgentNetworkUsageRows mocks base method.
 func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkUsage, error) {
 	m.ctrl.T.Helper()