feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeAdminUserStoreController.php

@@ -51,6 +51,18 @@ final class AgentNodeAdminUserStoreController extends Controller
                 );
         }
 
+        // Agent accounts can only create admin users on their own node, not descendants
+        $primaryNode = AdminAgentScope::primaryAgentNode($admin);
+        if ($primaryNode !== null && (int) $primaryNode->id !== (int) $agent_node->id) {
+            return ApiMessage::errorResponse(
+                $request,
+                'admin.agent_user_manage_denied',
+                ErrorCode::AdminForbidden->value,
+                null,
+                403,
+            );
+        }
+
         $user = $service->createUnderAgent($agent_node, $request->validated());
 
         AuditLogger::recordForAdmin(

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeProfileController.php

@@ -51,6 +51,7 @@ final class AgentNodeProfileController extends Controller
             : null;
 
         $payload = $request->validated();
+
         if ($parent !== null) {
             $service->assertChildCapabilityGrantsWithinParent($parent, $payload, $admin);
         }

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeRoleStoreController.php

@@ -51,6 +51,18 @@ final class AgentNodeRoleStoreController extends Controller
                 );
         }
 
+        // Agent accounts can only create roles on their own node, not descendants
+        $primaryNode = AdminAgentScope::primaryAgentNode($admin);
+        if ($primaryNode !== null && (int) $primaryNode->id !== (int) $agent_node->id) {
+            return ApiMessage::errorResponse(
+                $request,
+                'admin.agent_role_manage_denied',
+                ErrorCode::AdminForbidden->value,
+                null,
+                403,
+            );
+        }
+
         $role = $service->createForAgent($admin, $agent_node, $request->validated());
 
         AuditLogger::recordForAdmin(