feat: Bao/Iris-Statusrechte + Bao→Iris-Notifications + Agent-Workflow-Übersicht

- Bao darf jetzt Status ändern (neben Iris), Sub-Agents weiterhin nicht
- CanEditContent für Inhaltsbearbeitung durch alle bekannten Caller
- Bao-Content-Änderungen triggern task_content_changed-Notification an Iris
- Bao-Status-Änderungen triggern task_status_changed-Notification an Iris
- Iris-Status-Änderungen triggern task_status_changed-Notification an Bao
- Neue WorkTask-Felder: IsAgentTask (bool), ExpectedFrom (string)
- Agent-Workflow-API: CreateAgentTask, WaitingTasks, AgentOverview
- Frontend: Agent-Task-Badge, Iris-Overview-Panel, isBao-Getter
- Login-Rate-Limiter mit strukturiertem JSON-Fehlermeldungs-Body
- Volume-Name: nexus-postgres → postgres-data (Standardisierung)

backend/Controllers/DashboardController.cs

@@ -164,18 +164,18 @@ public class DashboardController(
     public async Task<ActionResult<DashboardTaskDto>> UpdateTaskStatus(
         Guid id, [FromBody] UpdateDashboardTaskStatusRequest request, CancellationToken ct)
     {
-        // Bao review gate: Check if moving OUT of Review
+        // Enforce workflow rules based on caller agent
         var currentTask = await taskService.GetByIdAsync(id, ct);
-        if (currentTask is not null &&
-            string.Equals(currentTask.State, "Review", StringComparison.OrdinalIgnoreCase) &&
-            !string.Equals(request.Status, "Review", StringComparison.OrdinalIgnoreCase))
+        if (currentTask is null)
+            return NotFound(new { error = "Task not found." });
+
+        // Resolve caller agent from header or JWT
+        var callerAgent = ResolveCallerAgent();
+
+        // Nur Iris und Bao dürfen Status ändern
+        if (!TaskStateHelper.CanChangeState(callerAgent, currentTask))
         {
-            var user = httpContextAccessor.HttpContext?.User;
-            var isOwner = user?.IsInRole("Owner") == true ||
-                          user?.IsInRole("owner") == true ||
-                          user?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value == "bao";
-            if (!isOwner)
-                return StatusCode(403, new { error = "Only the owner can move tasks out of Review." });
+            return StatusCode(403, new { error = "Statusänderungen sind nur Iris und Bao vorbehalten. Sub-Agenten können Tasks nicht verschieben." });
         }
 
         var result = await taskService.UpdateStatusAsync(id, request.Status, ct);
@@ -190,7 +190,7 @@ public class DashboardController(
     // ── Task Board Endpoints ──
 
     [HttpGet("tasks/board")]
-    public async Task<TaskBoardResponse> GetBoard(CancellationToken ct)
+    public async Task<BoardResponse> GetBoard(CancellationToken ct)
         => await taskService.GetBoardAsync(ct);
 
     [HttpPatch("tasks/{id:guid}/move")]
@@ -200,18 +200,18 @@ public class DashboardController(
         if (string.IsNullOrWhiteSpace(request.State))
             return BadRequest(new { error = "State is required." });
 
-        // Bao review gate: Check if moving OUT of Review
+        // Enforce workflow rules based on caller agent
         var currentTask = await taskService.GetByIdAsync(id, ct);
-        if (currentTask is not null &&
-            string.Equals(currentTask.State, "Review", StringComparison.OrdinalIgnoreCase) &&
-            !string.Equals(request.State, "Review", StringComparison.OrdinalIgnoreCase))
+        if (currentTask is null)
+            return NotFound(new { error = "Task not found." });
+
+        // Resolve caller agent from header or JWT
+        var callerAgent = ResolveCallerAgent();
+
+        // Nur Iris und Bao dürfen Status ändern
+        if (!TaskStateHelper.CanChangeState(callerAgent, currentTask))
         {
-            var user = httpContextAccessor.HttpContext?.User;
-            var isOwner = user?.IsInRole("Owner") == true ||
-                          user?.IsInRole("owner") == true ||
-                          user?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value == "bao";
-            if (!isOwner)
-                return StatusCode(403, new { error = "Only the owner can move tasks out of Review." });
+            return StatusCode(403, new { error = "Statusänderungen sind nur Iris und Bao vorbehalten. Sub-Agenten können Tasks nicht verschieben." });
         }
 
         var result = await taskService.MoveTaskAsync(id, request.State, ct);
@@ -223,6 +223,24 @@ public class DashboardController(
         };
     }
 
+    /// <summary>
+    /// Resolves the caller identity: checks X-Agent-Id header, then JWT name claim.
+    /// Falls back to empty string (which authorization helpers reject accordingly).
+    /// </summary>
+    private string ResolveCallerAgent()
+    {
+        var httpContext = httpContextAccessor.HttpContext;
+        if (httpContext is null) return "";
+
+        var agentHeader = httpContext.Request.Headers["X-Agent-Id"].FirstOrDefault();
+        if (!string.IsNullOrWhiteSpace(agentHeader))
+            return agentHeader.Trim().ToLowerInvariant();
+
+        var user = httpContext.User;
+        var nameClaim = user?.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
+        return nameClaim?.ToLowerInvariant() ?? "";
+    }
+
     // ── New Endpoints: Reset Stale, Children, Activity ──
 
     [HttpPost("tasks/reset-stale")]
@@ -277,7 +295,59 @@ public class DashboardController(
         return Created($"/api/dashboard/tasks/{id}/activity/{ev.Id}", ev);
     }
 
+    // ── Agent Workflow Endpoints (Iris Overview) ──
+
+    /// <summary>
+    /// Returns agent-tasks that are still open and waiting for input.
+    /// Iris uses this to see who she is waiting for.
+    /// </summary>
+    [HttpGet("tasks/agent-waiting")]
+    public async Task<ActionResult<List<DashboardTaskDto>>> GetAgentWaitingTasks(CancellationToken ct)
+    {
+        var waiting = await taskService.GetWaitingTasksAsync(ct);
+        return Ok(waiting.Select(MapToDto).ToList());
+    }
+
+    /// <summary>
+    /// Returns a complete agent-workflow overview grouped by expected respondent
+    /// + stale detection. This is the main Iris dashboard data.
+    /// </summary>
+    [HttpGet("tasks/agent-overview")]
+    public async Task<ActionResult<AgentWorkflowOverview>> GetAgentOverview(
+        CancellationToken ct, [FromQuery] int staleHours = 2)
+    {
+        var threshold = TimeSpan.FromHours(Math.Max(1, staleHours));
+        return Ok(await taskService.GetAgentWorkflowOverviewAsync(threshold, ct));
+    }
+
+    /// <summary>
+    /// Creates an agent-task: a task that is tracked as originating from the agent workflow.
+    /// Sub-agents (programmer, reviewer) can only CREATE, not move state.
+    /// </summary>
+    [HttpPost("tasks/agent")]
+    public async Task<ActionResult<DashboardTaskDto>> CreateAgentTask(
+        [FromBody] CreateAgentTaskRequest request, CancellationToken ct)
+    {
+        if (string.IsNullOrWhiteSpace(request.Title))
+            return BadRequest(new { error = "Title is required." });
+
+        try
+        {
+            var task = await taskService.CreateAgentTaskAsync(
+                request.Title, request.Detail, request.Source ?? "iris",
+                request.Priority, request.AssignedTo, request.ExpectedFrom,
+                request.ParentTaskId, ct);
+
+            return Created($"/api/dashboard/tasks/{task.Id}", MapToDto(task));
+        }
+        catch (ArgumentException ex)
+        {
+            return BadRequest(new { error = ex.Message });
+        }
+    }
+
     private static DashboardTaskDto MapToDto(WorkTask t) => new(
         t.Id, t.Title, t.Detail, t.Source, t.State, t.Priority, t.AssignedTo,
-        t.ParentTaskId, t.DueDate, t.CreatedAt, t.UpdatedAt);
+        t.ParentTaskId, t.DueDate, t.CreatedAt, t.UpdatedAt,
+        t.IsAgentTask, t.ExpectedFrom);
 }