refactor: package code organization wave 10 (#2328)
## Summary
Wave 10 of package code organization (plan:
`docs/plans/2026-07-14-001-refactor-package-code-organization-plan.md`),
after #2274.
### Peels
| New module | Parent |
|---|---|
| `types/agents.ts` | `types.ts` (permissions, Agent entity, ratings,
reflections, heartbeat run types) |
| `app/api/missions.ts` | `legacy.ts` (hierarchy, assertions,
validation, autopilot) |
| `app/api/messaging.ts` | `legacy.ts` (mailbox, approvals,
reflections/ratings, budget) |
| `app/api/plugins-and-skills.ts` | `legacy.ts` |
| `app/api/todo.ts` | `legacy.ts` |
| `app/api/insights.ts` | `legacy.ts` |
| `app/api/system-panel.ts` | `legacy.ts` |
| `task-store/workflow-definitions.ts` | rename of `remaining-ops-8` |
Mission interview SSE streams stay in `legacy.ts` until
`createResilientEventSource` is shared.
Public paths stay stable via re-exports.
### LOC
- `types.ts` ~7101 → ~6165
- `legacy.ts` ~10273 → ~8913
### Shims
- `types.ts` → `types/agents.ts` (delete-when: consumers import agents
domain directly)
- `legacy.ts` → peels above (delete-when: dashboard imports domain
modules)
- `remaining-ops-8` → `workflow-definitions` (rename complete)
## Test plan
- [x] `@fusion/core` typecheck
- [x] eslint on peeled dashboard API modules
- [x] `pnpm check:line-count`
- [x] `agent-permissions` + `agent-permission-policy` tests
- [x] `plugin-setup-api` tests
- [ ] CI merge gate
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added typed dashboard API support for missions, milestones/features,
validation loops, and autopilot.
* Added insights browsing and management, including run triggering.
* Added messaging/mailboxes and approvals, plus agent reflections,
ratings, and budget controls.
* Added plugins & skills management and discovery.
* Added todo lists and items with reordering.
* Added system monitoring controls: rebuilds/restarts, logs, and
research finding promotion.
* **Improvements**
* Centralized agent-related type contracts for safer browser
consumption.
* Enhanced legacy API compatibility and improved AI session deletion
error handling.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
3bf7f92be0