cloud-agents Worker (v1)
Routes: /ca/{start,stop,rm,list} (Bearer), /ca/verify/* (Bearer, verify token), /s/:name/* (Basic, user "opencode")