Allow Agent Connections via remote feature flag

[AnthonyRonning]

Summary

• make the Agent Connections settings surface available when either the local VITE_FORCE_FEATURE_FLAGS override or the user-scoped remote agent_connections OS flag is enabled
• use Maple existing isTauriDesktop, isMacOS, and isLinux platform helpers for the current macOS/Linux ACP support boundary
• use the existing FlagsClient.peekIsEnabled and FlagsClient.isEnabled path, which already implements local override OR remote lookup
• share one tri-state availability decision between settings navigation and direct routing so they cannot disagree or redirect during a cold flag lookup
• keep ACP lifecycle unchanged: the flag only reveals the settings surface and never starts an ACP server automatically

Why this is a follow-up

PR #732 landed the Maple-owned agent service and ACP boundary. This deliberately small follow-up adds production-ready discovery gating without mixing flag behavior into that architecture change.

Behavior

Agent Connections is visible only when all of the following are true:

1. Maple is running as a Tauri desktop app.
2. Maple existing platform helpers report macOS or Linux, matching the current Unix-only ACP transport.
3. An authenticated user is available.
4. Either the local override contains agent_connections, or the remote OS Flags service enables agent_connections for that user.

Missing users, unsupported platforms, false flags, and lookup errors remain unavailable. Cached flag values are used immediately; otherwise the route waits for the lookup rather than briefly redirecting.

Operational setup

The agent_connections key must be created with a default of false in each OS Flags environment before remote targeting can enable it. The key is currently absent from both development and production, which is safely equivalent to disabled.

Successful remote values may remain cached in the client for up to 10 minutes. This flag controls discoverability, not authorization and not the lifecycle of an already-running ACP server.

Validation

• 511 frontend tests passed
• production frontend build passed
• TypeScript typecheck passed
• Prettier passed
• ESLint passed with the same 13 pre-existing warnings and no errors
• git diff --check passed
• platform.ts is byte-for-byte identical to origin/master
• fresh-context code review found no remaining actionable issues or competing runtime abstractions

Exact-worktree desktop smoke

• provisioned deterministic local accounts and passed the managed OpenSecret, billing, Continuum, and extended-health smoke
• built and launched the exact PR worktree Maple.app with its unique managed-workspace bundle identifier and VITE_FORCE_FEATURE_FLAGS=agent_connections
• verified the local override exposes the Agent Connections navigation entry
• verified the direct /settings/agent-connections route renders correctly
• verified the displayed ACP command points to this exact PR worktree bundle
• verified the ACP service remains stopped and requires an explicit manual start

The local debug packaging command reached and produced the app, DMG, and updater archive before reporting the expected absence of TAURI_SIGNING_PRIVATE_KEY; the exact generated app launched and completed the smoke successfully.

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	b046674
Status:	✅  Deploy successful!
Preview URL:	https://41969af0.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-agent-connection.maple-ca8.pages.dev

View logs