fix(api): scope agent_cache key_prefix invalidate to cache namespace

bugbot HIGH: applyAgentInvalidate's key_prefix branch built a SCAN
pattern as `<filter_value>*` without prepending `<cache.name>:`,
unlike the tool/session branches. This let a key_prefix invalidation
match keys belonging to other caches or unrelated application data on
the same Valkey instance. Scope the pattern to the cache namespace and
add a regression test.

Author: jamby77

apps/api/src/cache-proposals/__tests__/cache-apply.dispatcher.spec.ts

@@ -20,8 +20,12 @@ class FakeClient {
     return keys.length;
   }
 
-  async scan(cursor: string, _match: string, _pattern: string, _count: string, _n: number): Promise<[string, string[]]> {
-    return [cursor === '0' ? '0' : '0', []];
+  public scanCalls: string[] = [];
+  public scanResults: string[] = [];
+
+  async scan(_cursor: string, _match: string, pattern: string, _count: string, _n: number): Promise<[string, string[]]> {
+    this.scanCalls.push(pattern);
+    return ['0', this.scanResults];
   }
 
   public ftSearchResponse: unknown = [0];
@@ -153,6 +157,24 @@ describe('CacheApplyDispatcher', () => {
     expect(out.actualAffected).toBe(3);
   });
 
+  it('agent invalidate by key_prefix scopes the SCAN pattern to the cache namespace', async () => {
+    const client = new FakeClient();
+    const dispatcher = buildDispatcher(AGENT_CACHE, client);
+    await dispatcher.dispatch(
+      proposal({
+        cache_name: 'ac:prod',
+        cache_type: 'agent_cache',
+        proposal_type: 'invalidate',
+        proposal_payload: {
+          filter_kind: 'key_prefix',
+          filter_value: 'memo:',
+          estimated_affected: 5,
+        },
+      }),
+    );
+    expect(client.scanCalls).toEqual(['ac:prod:memo:*']);
+  });
+
   it('fails when cache type changed since proposal creation', async () => {
     const client = new FakeClient();
     const dispatcher = buildDispatcher(AGENT_CACHE, client);

apps/api/src/cache-proposals/cache-apply.dispatcher.ts

@@ -208,7 +208,7 @@ export class CacheApplyDispatcher {
       };
     }
     if (payload.filter_kind === 'key_prefix') {
-      const pattern = `${escapeGlob(payload.filter_value)}*`;
+      const pattern = `${escapeGlob(cache.name)}:${escapeGlob(payload.filter_value)}*`;
       const deleted = await scanAndDelete(client, pattern);
       return {
         actualAffected: deleted,