feat: enhance admin role management and reconciliation features

- Updated AGENTS.md to clarify site admin roles and their associated permissions.
- Refactored reconciliation controllers to include admin user validation and improved access control based on admin roles.
- Enhanced AdminReconcileJobService to support player-specific reconciliation and site-based job creation.
- Removed deprecated rebate commission report functionality from the API and related services.
- Improved dashboard overview builders to accommodate new site operator roles and their specific functionalities.

app/Http/Controllers/Api/V1/Admin/Reconcile/ReconcileJobShowController.php

@@ -3,15 +3,24 @@
 namespace App\Http\Controllers\Api\V1\Admin\Reconcile;
 
 use App\Models\ReconcileJob;
+use App\Support\AdminReconcileScope;
 use App\Support\ApiResponse;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use App\Http\Controllers\Controller;
 
 /** GET /api/v1/admin/reconcile-jobs/{reconcile_job} */
 final class ReconcileJobShowController extends Controller
 {
-    public function __invoke(ReconcileJob $reconcile_job): JsonResponse
+    public function __invoke(Request $request, ReconcileJob $reconcile_job): JsonResponse
     {
+        $admin = $request->lotteryAdmin();
+        abort_if($admin === null, 401);
+
+        if ($denied = AdminReconcileScope::denyUnlessJobAccessible($admin, $reconcile_job)) {
+            return $denied;
+        }
+
         return ApiResponse::success([
             'id' => (int) $reconcile_job->id,
             'job_no' => $reconcile_job->job_no,