fix(console): read the web allowlist per channel, not once at startup

[traviswu-bigstack]

/kind bug

What

The agent reads /etc/cube-advisor-agent/web-targets.json on every web channel now, instead of once at startup.

Why

The allowlist changes underneath a running agent, by design — advisor target_set writes it, and config_advisor's Commit seeds one on a node that had none. Reading it once meant every such change needed a restart, and the failure pointed away from the cause:

agent: web channel for "cube-cos-idp" ended:
  console: target is not in this node's web allowlist: "cube-cos-idp"

# ... while the file said:
{"cube-cos":"10.32.1.200:443","cube-cos-idp":"10.32.1.200:10443", …}

Three times on the 1cc r630 this session — cube-cos-idp, then cube-cos-skyline and cube-cos-ceph. Each one looked like a proxy bug until the file was read side by side with the agent's own startup line (serving … 3 web targets against four in the file). systemctl restart cube-advisor-agent fixed it every time, which is a step nobody should have to know to run.

How

WebHandler.Allow becomes a WebResolver — WebAllowlist still satisfies it, so every existing test is unchanged, and FileAllowlist{Path} resolves against the file each time.

Re-reading costs one small read per channel, and a channel is opened by a person clicking a button. Startup still parses the file once, where an operator is watching, so a malformed one is refused before the agent claims to be serving anything.

A file that stops parsing later refuses rather than falling back to the last good copy. An allowlist nobody can read is not one to keep enforcing from memory — the allowlist is the node's veto over what the Advisor may dial, and the safe direction when it becomes unreadable is to dial nothing.

Testing

go test ./... clean.

Two cases added: a target added after startup resolves without a restart (before it is added, it refuses with ErrNotAllowed), and a file that stops parsing refuses rather than serving the last good copy.

Reviewer notes

WebHandler.Allow is now an interface, so a nil one refuses everything explicitly rather than panicking — the doc comment said "empty refuses everything" and that stays true of nil.

The other half of this — seeding the targets so an operator has fewer to set by hand — is bigstack-oss/cubecos#1482.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PZ5umjjCedZwWtbAbiMjfj

---

Tracked by #45.