T14/Bug #4 #5 #6 #8 #10: commit in-flight worker fixes (agents _all sentinel, settings useThemeStore, 5 detail route registrations)

Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.

- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
  when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
  (Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
  detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
  into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
  last 100 activity items instead of falling into /:id/activity with
  id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
  pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
  (t_cc5d9887 and t_296f0121); changes are additive and don't regress.

Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.

Parent: t_e1cbd87d

apps/api/src/routes/agents.ts

@@ -176,24 +176,6 @@ agentRoutes.delete("/:id", async (c) => {
   }
 });
 
-// GET /api/agents/:id/activity — Agent activity log
-agentRoutes.get("/:id/activity", async (c) => {
-  try {
-    await requireAuth(c);
-    const id = c.req.param("id");
-    const items = await db.select()
-      .from(agentActivity)
-      .where(eq(agentActivity.agentId, id))
-      .orderBy(desc(agentActivity.createdAt))
-      .limit(100);
-    return c.json({ items, totalItems: items.length });
-  } catch (error) {
-    if (error instanceof AuthError) return c.json({ error: { code: error.code, message: error.message } }, error.status as any);
-    console.error("[agents] GET /:id/activity error:", error);
-    return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to get agent activity" } }, 500);
-  }
-});
-
 // POST /api/agents/:id/permissions — Set permissions
 agentRoutes.post("/:id/permissions", async (c) => {
   try {
@@ -241,3 +223,37 @@ agentRoutes.get("/:id/permissions", async (c) => {
     return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to get permissions" } }, 500);
   }
 });
+
+// GET /api/agents/activity — All activity (bare path, no agent filter)
+agentRoutes.get("/activity", async (c) => {
+  try {
+    await requireAuth(c);
+    const items = await db.select()
+      .from(agentActivity)
+      .orderBy(desc(agentActivity.createdAt))
+      .limit(100);
+    return c.json({ items, totalItems: items.length });
+  } catch (error) {
+    if (error instanceof AuthError) return c.json({ error: { code: error.code, message: error.message } }, error.status as any);
+    console.error("[agents] GET /activity error:", error);
+    return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to get activity" } }, 500);
+  }
+});
+
+// GET /api/agents/:id/activity — Agent activity log (or all if id=_all)
+agentRoutes.get("/:id/activity", async (c) => {
+  try {
+    await requireAuth(c);
+    const id = c.req.param("id");
+    const items = await db.select()
+      .from(agentActivity)
+      .where(id === "_all" ? undefined : eq(agentActivity.agentId, id))
+      .orderBy(desc(agentActivity.createdAt))
+      .limit(100);
+    return c.json({ items, totalItems: items.length });
+  } catch (error) {
+    if (error instanceof AuthError) return c.json({ error: { code: error.code, message: error.message } }, error.status as any);
+    console.error("[agents] GET /:id/activity error:", error);
+    return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to get agent activity" } }, 500);
+  }
+});