Topology for one connection's agents

The same graph as /v1/otel/topology, restricted to what this connection's agents reach: the agents, the policies they hold, the vaults those grant, the chains they sign on and the systems they call. Restricted before the 500-node cap, so a large org's cap cannot cut the connection's own agents out. Walking is directed (agent → policy → vault), so a vault shared with another tenant's agent does not reveal that agent.

A plt_ key sees one connection's agents, never the end-user's org: that org may hold agents from other platforms or the user's own. The set is agents attributed to the connection plus the ones listed on it, constrained to the connection's org. A connection that does not belong to the calling app is a 404.