refactor: route brand protocol tools through training agent

[bokelley]

Summary

• Brand sandbox tools (sandbox_get_brand_identity, sandbox_get_rights, sandbox_acquire_rights, sandbox_update_rights) were custom Addie tools with a bespoke interface that didn't match the AdCP protocol surface
• Refactors them into standard AdCP tools (get_brand_identity, get_rights, acquire_rights, update_rights) that route through the training agent via agent_url, matching the pattern used by media buy, creative, signals, and governance tools
• Learners now use the same tools they'll use in production, just pointed at a sandbox agent — one tool surface, two backends

Changes

• New: server/src/training-agent/brand-handlers.ts — seed data + handlers (ported from deleted file)
• New: server/src/db/migrations/313_c2_brand_tools_rename.sql — renames tool refs in C2 exercises
• Modified: adcp-tools.ts — adds ADCP_BRAND_PROTOCOL_TOOLS with agent_url routing
• Modified: task-handlers.ts — wires brand handlers into training agent dispatch
• Modified: tool-sets.ts — updates certification + adcp_operations sets
• Deleted: brand-sandbox-tools.ts + all references in bolt-app.ts, register-baseline-tools.ts
• Bonus: fixes in-process shortcut hostname check (security review finding)

Test plan

• 36 brand handler tests pass (Jest)
• 179 training agent unit tests pass (vitest)
• Full suite: 499 tests pass
• Typecheck clean
• Code review: all Must Fix and Should Fix items addressed
• Security review: all findings addressed

🤖 Generated with Claude Code