feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

app/Http/Controllers/Api/V1/Admin/Agent/AgentNodeAdminUserStoreController.php

@@ -51,6 +51,18 @@ final class AgentNodeAdminUserStoreController extends Controller
                 );
         }
 
+        // Agent accounts can only create admin users on their own node, not descendants
+        $primaryNode = AdminAgentScope::primaryAgentNode($admin);
+        if ($primaryNode !== null && (int) $primaryNode->id !== (int) $agent_node->id) {
+            return ApiMessage::errorResponse(
+                $request,
+                'admin.agent_user_manage_denied',
+                ErrorCode::AdminForbidden->value,
+                null,
+                403,
+            );
+        }
+
         $user = $service->createUnderAgent($agent_node, $request->validated());
 
         AuditLogger::recordForAdmin(