merge: gRPC server + hub + 跨实例 pub/sub [tsk_mF5RWPEwngai]

Resolve merge conflict between maestro/tsk__58l3wTLvaSn (gRPC nodes feature)
and main (admin backend + JWT config + OpenAPI routes):

- server/cmd/server/main.go: keep admin backend (startAdminIfConfigured) AND
  add gRPC agent server (startGRPC) — both coexist as independent optional
  listeners governed by their respective env vars
- server/internal/config/config.go: keep JWT fields (JWTPrivateKeyPath /
  JWTKeyID / JWTPublicKeys) AND add gRPC fields (GRPCAddr / CAKeyPath /
  CACertPath / GRPCCertPath / GRPCKeyPath)
- server/internal/nodes/: add all new files from tsk__58l3wTLvaSn
  (hub.go, hub_test.go, load.go, handler_grpc.go, grpc_test.go,
   service.go, store.go) — 18 tests, all passing

Test: go test ./internal/nodes/... → PASS (18/18)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/internal/config/config.go

@@ -48,6 +48,24 @@ type Config struct {
 	// active key's kid and may carry previous keys still accepted during
 	// rotation. Parsed from JWT_PUBLIC_KEYS="kid1:/path1,kid2:/path2".
 	JWTPublicKeys map[string]string
+
+	// ─── gRPC / agent server ──────────────────────────────────────────────
+
+	// GRPCAddr is the listen address for the mTLS gRPC agent server (host:port).
+	// Optional: if empty, the gRPC server is not started.
+	// Example: ":9443"
+	GRPCAddr string
+
+	// CAKeyPath and CACertPath are file paths for the Pangolin Node CA.
+	// Required when GRPCAddr is set.
+	CAKeyPath  string
+	CACertPath string
+
+	// GRPCCertPath and GRPCKeyPath are the TLS certificate/key used by the gRPC
+	// listener for its own transport credential (distinct from the node CA).
+	// Required when GRPCAddr is set.
+	GRPCCertPath string
+	GRPCKeyPath  string
 }
 
 // FromEnv reads configuration from environment variables.
@@ -66,6 +84,12 @@ func FromEnv() (*Config, error) {
 		JWTPrivateKeyPath:         os.Getenv("JWT_PRIVATE_KEY_PATH"),
 		JWTKeyID:                  os.Getenv("JWT_KEY_ID"),
 		JWTPublicKeys:             parseKeyMap(os.Getenv("JWT_PUBLIC_KEYS")),
+		// gRPC server (optional)
+		GRPCAddr:     os.Getenv("GRPC_ADDR"),
+		CAKeyPath:    os.Getenv("CA_KEY_PATH"),
+		CACertPath:   os.Getenv("CA_CERT_PATH"),
+		GRPCCertPath: os.Getenv("GRPC_CERT_PATH"),
+		GRPCKeyPath:  os.Getenv("GRPC_KEY_PATH"),
 	}
 
 	if c.DSN == "" {