feat(agentnetwork): thread the zone config through to the manager

Adds AgentNetwork.Zone to the management config and passes it to the
agent-network manager, alongside the existing plumbing in the combined
binary. Nothing reads it yet -- the allocator that stamps it onto new rows
comes next -- so this commit is inert on its own.

management/internals/server/config/config.go

@@ -67,6 +67,15 @@ type Config struct {
 	HighestSupportedSyncMessageVersion *int
 
 	PerAccountHighestSupportedSyncMessageVersion map[string]int
+
+	// AgentNetworkZone is the parent DNS zone that Agent Network gateway
+	// endpoints are allocated under, producing <subdomain>.<zone>.
+	//
+	// Empty (the default) preserves the legacy behaviour of deriving the
+	// endpoint from the serving cluster, so self-hosted deployments are
+	// unaffected. It is captured onto each settings row when that row is
+	// created; changing it later does not move existing tenants.
+	AgentNetworkZone string
 }
 
 // GetAuthAudiences returns the audience from the http config and device authorization flow config

management/internals/server/modules.go

@@ -202,6 +202,7 @@ func (s *BaseServer) AgentNetworkManager() agentnetwork.Manager {
 			s.PermissionsManager(),
 			s.AccountManager(),
 			s.ServiceProxyController(),
+			s.Config.AgentNetworkZone,
 		)
 		// Sweep expired agent-network access logs per account retention,
 		// reusing the reverse-proxy cleanup interval config.