feat(nodes): gRPC server + Hub + Redis pub/sub cross-instance delivery (tsk__58l3wTLvaSn)

Implements AgentService gRPC server with all 6 RPCs (Enroll/Register/Heartbeat/
Subscribe/Ack/ReportUsage), Hub command routing with Redis ZSET at-least-once
persistence and cross-instance pub/sub delivery, LoadCache for node:load metrics,
NodeStore SQL interface + MySQL implementation, and full mTLS gRPC listener in main.

Integration tests: 18 tests covering full Enroll→Register→Heartbeat→Subscribe→Ack
flow, reconnect resume with last_command_id, and cross-instance pub/sub delivery
via bufconn + miniredis + mockNodeStore + real mTLS certificates.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/internal/config/config.go

@@ -37,6 +37,24 @@ type Config struct {
 	// WebhookNonceTTL is how long a webhook nonce is kept in Redis to prevent replay.
 	// Should be > 2 * WebhookTimestampTolerance.  Default: 15 minutes.
 	WebhookNonceTTL time.Duration
+
+	// ─── gRPC / agent server ──────────────────────────────────────────────
+
+	// GRPCAddr is the listen address for the mTLS gRPC agent server (host:port).
+	// Optional: if empty, the gRPC server is not started.
+	// Example: ":9443"
+	GRPCAddr string
+
+	// CAKeyPath and CACertPath are file paths for the Pangolin Node CA.
+	// Required when GRPCAddr is set.
+	CAKeyPath  string
+	CACertPath string
+
+	// GRPCCertPath and GRPCKeyPath are the TLS certificate/key used by the gRPC
+	// listener for its own transport credential (distinct from the node CA).
+	// Required when GRPCAddr is set.
+	GRPCCertPath string
+	GRPCKeyPath  string
 }
 
 // FromEnv reads configuration from environment variables.
@@ -52,6 +70,12 @@ func FromEnv() (*Config, error) {
 		RedeemLockDuration:        time.Hour,
 		WebhookTimestampTolerance: 5 * time.Minute,
 		WebhookNonceTTL:           15 * time.Minute,
+		// gRPC server (optional)
+		GRPCAddr:     os.Getenv("GRPC_ADDR"),
+		CAKeyPath:    os.Getenv("CA_KEY_PATH"),
+		CACertPath:   os.Getenv("CA_CERT_PATH"),
+		GRPCCertPath: os.Getenv("GRPC_CERT_PATH"),
+		GRPCKeyPath:  os.Getenv("GRPC_KEY_PATH"),
 	}
 
 	if c.DSN == "" {