fix(cloud-wallet): harden holder isolation and agent routing

[sign-mark]

Context

CREDEBL Platform resolves a Holder Cloud Wallet record and uses its tenant token to call the shared Agent Controller. This issue remains limited to the Holder Cloud Wallet path and does not change issuer or verifier behaviour, the Agent Controller JWT format, or token lifecycle.

Related background: #1054, #1352, and #1442.

Problems

• Holder wallet lookup did not explicitly require the authenticated user and CLOUD_SUB_WALLET type.
• Base-wallet configuration required authentication but not platform-administrator authorization.
• The Holder Agent health check called the protected agent endpoint without the Holder tenant token.
• Proof record and collection URLs contained stray characters and did not use structured query parameters.

Backward-compatible hardening

• Resolve Holder wallets by authenticated userId and CLOUD_SUB_WALLET type.
• Reject unresolved Holders before reading Base Wallet or tenant credentials.
• Restrict Base Wallet configuration to platform administrators.
• Authenticate Agent health checks with the resolved Holder tenant token.
• Use the exact Agent Controller proof routes and pass threadId through HTTP query parameters.
• Preserve existing Holder-facing API request and response shapes.

Acceptance criteria

• A Holder operation can resolve only that authenticated Holder CLOUD_SUB_WALLET record.
• A Base Wallet record can never be selected for a Holder operation.
• A non-admin authenticated user cannot configure the Base Wallet.
• Agent health checks use the resolved Holder tenant token.
• Proof collection and record requests use the exact Agent Controller routes.
• Existing valid Holder Cloud Wallet operations continue without client request changes.
• Tests cover cross-Holder access, Base/Sub Wallet confusion, Base Wallet authorization, authenticated health checks, and Proof URL construction.

Follow-up boundary

Short-lived tenant tokens, token rotation or revocation, Issuer Cloud Wallet design, KMS integration, and database singleton enforcement remain separate follow-up work.