Implement remote execution

src/api/strategy/mod.rs

@@ -33,3 +33,21 @@ fn serialize(r: &ResolvedStrategy) -> (i64, Value) {
         }),
     )
 }
+
+/// `true` iff the resolved strategy for `peer_id` carries
+/// `config_options."enable-remote-exec" = "Y"`. Default is `false` (no
+/// strategy assigned, or strategy didn't set the key) — exec is opt-in
+/// per the design in docs/AGENT-API-AUTH.md.
+pub async fn allows_remote_exec(state: &AppState, peer_id: &str) -> bool {
+    let resolved = state
+        .db
+        .strategy_resolve_for(peer_id)
+        .await
+        .unwrap_or_default();
+    let cfg: Value = serde_json::from_str(&resolved.config_options_json)
+        .unwrap_or_else(|_| json!({}));
+    cfg.get("enable-remote-exec")
+        .and_then(|v| v.as_str())
+        .map(|s| s.eq_ignore_ascii_case("Y"))
+        .unwrap_or(false)
+}