feat(federation): relay agreement management and local zones

flowchart LR
  P["portal<br/>Agreements dialog"] -- "operator role" --> R
  subgraph OEG["OEG /platform/v1/federation (stores nothing, no TF-SDK)"]
    R["GET /local-zones<br/>POST /agreements<br/>PATCH /agreements/{agreementId}<br/>GET /partners/{id} (agreements embedded)"]
  end
  R -- "relay, FM ProblemDetails passed through" --> FM["FM internal :8083<br/>/internal/local-zones<br/>/internal/agreements"]
  FM --> DB[("FM: agreements,<br/>which zones are local")]

Operators need to manage agreements from the portal without direct access to FM. Add authenticated operator relays for agreement creation/update and our local-zone list, and retain embedded agreements in partner detail.

FM owns validation, agreement persistence and which zones are local. OEG validates the relay contracts and passes FM responses through; it does not store federation state or call TF-SDK. The routes follow the existing partner-registry relay.

Validation: prior-session unit suite 1220 passed, mypy and ruff clean; the branch pipeline passed. Through the portal backend, the VM checks read local zones, listed agreements, updated status, and received field-specific ProblemDetails for invalid input.

Depends on FM's internal agreement/local-zone routes and the ADR-0051 amendment. The portal agreement dialog and Ansible-seeded agreements exercise the same FM write contract. OEG instance visibility remains a separate child MR so its change to read semantics can receive its own review.