🛡️ refactor: Scope Action Mutations by Parent Resource Ownership (#12237)

* 🛡️ fix: Scope action mutations by parent resource ownership

Prevent cross-tenant action overwrites by validating that an existing
action's agent_id/assistant_id matches the URL parameter before allowing
updates or deletes. Without this, a user with EDIT access on their own
agent could reference a foreign action_id to hijack another agent's
action record.

* 🛡️ fix: Harden action ownership checks and scope write filters

- Remove && short-circuit that bypassed the guard when agent_id or
  assistant_id was falsy (e.g. assistant-owned actions have no agent_id,
  so the check was skipped entirely on the agents route).
- Include agent_id / assistant_id in the updateAction and deleteAction
  query filters so the DB write itself enforces ownership atomically.
- Log a warning when deleteAction returns null (silent no-op from
  data-integrity mismatch).

* 📝 docs: Update Action model JSDoc to reflect scoped query params

* ✅ test: Add Action ownership scoping tests

Cover update, delete, and cross-type protection scenarios using
MongoMemoryServer to verify that scoped query filters (agent_id,
assistant_id) prevent cross-tenant overwrites and deletions at the
database level.

* 🛡️ fix: Scope updateAction filter in agent duplication handler

* 🐛 fix: Use action metadata domain instead of action_id when duplicating agent actions

The duplicate handler was splitting `action.action_id` by `actionDelimiter`
to extract the domain, but `action_id` is a bare nanoid that doesn't
contain the delimiter. This produced malformed entries in the duplicated
agent's actions array (nanoid_action_newNanoid instead of
domain_action_newNanoid). The domain is available on `action.metadata.domain`.

* ✅ test: Add integration tests for agent duplication action handling

Uses MongoMemoryServer with real Agent and Action models to verify:
- Duplicated actions use metadata.domain (not action_id) for the
  agent actions array entries
- Sensitive metadata fields are stripped from duplicated actions
- Original action documents are not modified

api/models/Action.js

@@ -4,9 +4,7 @@ const { Action } = require('~/db/models');
  * Update an action with new data without overwriting existing properties,
  * or create a new action if it doesn't exist.
  *
- * @param {Object} searchParams - The search parameters to find the action to update.
- * @param {string} searchParams.action_id - The ID of the action to update.
- * @param {string} searchParams.user - The user ID of the action's author.
+ * @param {{ action_id: string, agent_id?: string, assistant_id?: string, user?: string }} searchParams
  * @param {Object} updateData - An object containing the properties to update.
  * @returns {Promise<Action>} The updated or newly created action document as a plain object.
  */
@@ -47,10 +45,8 @@ const getActions = async (searchParams, includeSensitive = false) => {
 /**
  * Deletes an action by params.
  *
- * @param {Object} searchParams - The search parameters to find the action to delete.
- * @param {string} searchParams.action_id - The ID of the action to delete.
- * @param {string} searchParams.user - The user ID of the action's author.
- * @returns {Promise<Action>} A promise that resolves to the deleted action document as a plain object, or null if no document was found.
+ * @param {{ action_id: string, agent_id?: string, assistant_id?: string, user?: string }} searchParams
+ * @returns {Promise<Action|null>} The deleted action document as a plain object, or null if no match.
  */
 const deleteAction = async (searchParams) => {
   return await Action.findOneAndDelete(searchParams).lean();