feat(cli): castle mesh command + shared-config API + NATS integration tests

- castle mesh status|nodes|config (list/get/set) — hits the local castle-api;
  surfaces the shared-config write path (authority-gated)
- API: GET/PUT /mesh/config/{key:path}, GET /mesh/config; nats_client gains
  list_shared_config
- tests: NATS integration suite against a real broker via a docker fixture
  (peer discovery, presence, graceful-offline, shared config, secrets-off-wire);
  plus HTTP-layer /mesh/config tests. Closes the runtime-coverage gap.
- AGENTS.md §8 updated for NATS + the mesh CLI

100 api + 211 core tests pass.

castle-api/tests/test_mesh_config_api.py

@@ -0,0 +1,26 @@
+"""HTTP-layer tests for the /mesh/config endpoints (mesh-disabled paths).
+
+The write/read-through-the-client behavior is covered by test_nats_integration;
+here we pin the endpoint wiring when no mesh client is attached.
+"""
+
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+
+def test_list_config_reports_role_when_mesh_disabled(client: TestClient) -> None:
+    r = client.get("/mesh/config")
+    assert r.status_code == 200
+    body = r.json()
+    assert body["keys"] == []
+    assert body["role"] == "follower"  # test-node has no explicit role
+
+
+def test_get_missing_config_is_404(client: TestClient) -> None:
+    assert client.get("/mesh/config/does/not/exist").status_code == 404
+
+
+def test_write_without_mesh_is_503(client: TestClient) -> None:
+    r = client.put("/mesh/config/fleet/motd", json={"value": "x"})
+    assert r.status_code == 503