feat(a2a): External access panel + GET /api/a2a/settings

Adds GET /api/a2a/settings (enabled + publicBaseUrl) and an A2ASection in the
Fleet overview: enable/disable A2A for the workspace, mint/list/revoke external
bearer tokens (token shown once), and the discovery URL. Claw/skill publishing
is configured per-claw (follow-up).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/cm-api/src/routes/a2a.rs

@@ -96,6 +96,22 @@ pub async fn settings(
     Ok(Json(json!({ "enabled": body.enabled, "publicBaseUrl": base })))
 }
 
+/// GET /api/a2a/settings — current A2A opt-in state for the workspace.
+pub async fn get_settings(
+    State(state): State<AppState>,
+    Authed(user): Authed,
+) -> Result<Json<Value>, ApiError> {
+    let row = sqlx::query_as::<_, (bool, Option<String>)>(
+        "SELECT enabled, public_base_url FROM workspace_a2a WHERE workspace_id = $1",
+    )
+    .bind(user.workspace_id.as_uuid())
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|_| ApiError::Internal)?;
+    let (enabled, base) = row.unwrap_or((false, None));
+    Ok(Json(json!({ "enabled": enabled, "publicBaseUrl": base })))
+}
+
 #[derive(Deserialize)]
 pub struct MintTokenBody {
     /// Restrict the token to one claw alias, or `None` for any published claw.