Serve the A2A JSON-RPC surface (message/send, message/stream, tasks/get, tasks/resubscribe) for an agent flow.

Gated like the card route; apikey-folder flows additionally require a valid owner key (401). The flow runs as its owner. Returns the SDK's JSON-RPC response (HTTP 200 even for JSON-RPC-level errors). No DbSession dependency here: holding a session open across the run would fight the v2 surface's lock-avoidance design, and the gate/run resolve from flow_id via short self-managed sessions.