Agent tests have no controller stub for the proxy's credential paths #35

Test coverage gap in agentdesktop-dev#134 (part of agentdesktop-dev#86).

Problem

For ControllerJwt, api::gateway_credential calls the controller over gRPC with mTLS, and the agent test suite has no stub for it. The single-flight fetch is unit-tested at CredentialCache::get_or_fetch only. The 401 paths of forward with a freshly fetched credential (cache drop, no retry) and the 20 s fetch timeout have no test. Lab runs on a Linux VM cover the shared fetch end to end (8 concurrent requests, one controller issuance).

Expected

A test-only seam for the credential fetch in forward (for example a fetch function in ProxyConfig or AppState), so the proxy's credential paths can be tested with a counting stub.

🤖 Generated with Claude Code