fix(admin/a2a_queue): drop-stale endpoint for post-incident queue cleanup

[molecule-ai]

Summary

Adds POST /admin/a2a-queue/drop-stale — an ops endpoint to mark stale queued A2A items as 'dropped' after incidents. Closes #1947.

Problem

After incidents, PM agents inherit hour-old TASK-priority queue items from ICs that were correctly reporting "X is broken" while X was actually broken. Once X is fixed those items are stale noise — PMs spend ~5 min each writing "thanks, the issue is resolved".

Dev Lead had 30 post-incident queue items × ~5 min = ~2.5 hours of wasted PM time after the GitHub App token fix landed this morning. Manual SQL cleanup was applied as a hotfix — this endpoint makes it a proper ops tool.

Changes

• a2a_queue.go: DropStaleQueueItems(ctx, workspaceID, maxAgeMinutes) — UPDATE ... SET status='dropped' for queued items older than TTL. Uses FOR UPDATE SKIP LOCKED for concurrency safety with active drain calls.
• admin_queue.go: new AdminQueueHandler with DropStale HTTP handler (AdminAuth, ?max_age_minutes=N, &workspace_id=)
• admin_queue_test.go: HTTP-level tests for param validation and response shape
• router.go: registers POST /admin/a2a-queue/drop-stale behind AdminAuth

Usage

# Drop items older than 2h across all workspaces:
curl -X POST /admin/a2a-queue/drop-stale?max_age_minutes=120

# Scoped to one workspace:
curl -X POST /admin/a2a-queue/drop-stale?max_age_minutes=120&workspace_id=<uuid>

Returns {"dropped": N}.

Test plan

• admin_queue_test.go: 6 HTTP cases + SQL shape review
• CI passes
• Manual: verify old items marked dropped post-incident

Closes #1947.

🤖 Generated with Claude Code

[molecule-ai]

CP-BE Review — PR #1950: drop-stale endpoint

Approve. Clean, targeted ops fix. No blockers.

What I verified

a2a_queue.go — DropStaleQueueItems:

• Parameterized SQL (workspaceID, maxAgeMinutes as $1, $2) — no injection risk ✅
• FOR UPDATE SKIP LOCKED — safe against concurrent DrainQueueForWorkspace calls ✅
• Two branches: scoped (workspaceID != "") vs. global (workspaceID == "") ✅
• fmt.Errorf wrapping for error propagation ✅

admin_queue.go — AdminQueueHandler.DropStale:

• Uses AdminAuth middleware — properly gated ✅
• max_age_minutes validation: positive integer, rejects 0/negative ✅
• workspace_id optional (empty = all workspaces) ✅
• POST (not GET) — avoids accidental browser-triggered side effects ✅

router.go:

• Clean registration with comment explaining why POST ✅

admin_queue_test.go:

• 6 HTTP handler test cases (default, explicit, scoped, invalid, zero, negative) ✅
• SQL shape verification comment documents the expected query semantics ✅

Minor note (non-blocking)

last_error = last_error || '...' in PostgreSQL: if last_error is NULL for any queued row, the result of NULL || string is NULL, so the existing error context is lost. If last_error is guaranteed NOT NULL (never NULL for rows in the a2a_queue table), this is fine as-is. If NULLs are possible, consider COALESCE(last_error, '') || '...' for belt-and-suspenders. Non-blocking for merge.

Summary

Solid ops tooling. Exactly what was needed after the incident. Ship it.