feat: enhance agent management and validation logic

- Updated AGENTS.md to clarify agent account restrictions and permissions.
- Implemented checks in AgentNodeAdminUserStoreController and AgentNodeRoleStoreController to restrict admin user and role creation to the agent's own node.
- Enhanced validation in AdminPlayerStoreController and AdminPlayerUpdateController to enforce credit limit and rebate rate rules based on player funding mode.
- Refactored various request classes to utilize shared admin account field rules for consistency.
- Improved error handling in services related to credit allocation and rebate limits to ensure proper validation and messaging.

app/Support/AdminAgentNodeAccess.php

@@ -93,14 +93,22 @@ final class AdminAgentNodeAccess
             );
         }
 
+        // Only pure platform accounts (site admin without agent binding) can create under root node
+        // Agent accounts (even if they also have site roles) are restricted from creating under root
         if ($parent->isRoot() && ! $admin->isSuperAdmin()) {
-            return ApiMessage::errorResponse(
-                request(),
-                'admin.agent_root_create_denied',
-                ErrorCode::AdminForbidden->value,
-                null,
-                403,
-            );
+            $accessibleSiteIds = $admin->accessibleAdminSiteIds();
+            $hasAgentBinding = AdminAgentScope::primaryAgentNode($admin) !== null;
+            
+            // If user has agent binding, treat as agent account and restrict root creation
+            if ($hasAgentBinding || $accessibleSiteIds === null) {
+                return ApiMessage::errorResponse(
+                    request(),
+                    'admin.agent_root_create_denied',
+                    ErrorCode::AdminForbidden->value,
+                    null,
+                    403,
+                );
+            }
         }
 
         return null;