**Circular import prevention**: `pkg/agent/tools/` cannot import `internal/agent/`. Instead, function variables (`AgentCallFn`, `WorkflowTriggerFn`, `SkillExecuteFn`) are injected via `WireCallbacks()` at startup.
**Routes**: All under `/api/v1`. JWT via `middleware.JWTAuth()`, role checks via `middleware.RequireRole()`.