feat: POST /api/assign is the Asgard factory door

[jordanpartridge]

Summary

Kit's direct Asgard connection is assign, not chat.

• POST /api/assign Bearer KIT_PEER_TOKEN
• Body: { issue?, chair?, brief?, kind? }
• Writes board.json (issue-N or make_image / …) lifecycle=queued
• Enqueues DispatchKitWork (hallway _asgard assign_, no Kit LLM)
• /api/ask stays the human mouth

This is the door Asgard #133 kit_assign calls.

Test plan

• php artisan test --compact tests/Feature/AssignTest.php
• CI
• Loki queue:work --queue=kit running so hallway posts land

[lexi-chief-of-staff]

Blocking: none. Three small correctness / robustness notes called out inline.

• Token check is present and uses hash_equals.
• Board upsert + queue dispatch both happen before the 202 response.
• Test coverage for the happy paths and auth failure is solid.

No contradictions with existing patterns in the repo. Ship after addressing the three inline items if you want tighter validation and resilience.

[lexi-chief-of-staff]

Ship it.

• Token auth copied verbatim from AskController; same hash_equals guard.
• Empty-input check and boardId derivation handle the three input shapes (issue, kind, brief) without overlap.
• DispatchKitWork only posts to hallway; no LLM path introduced.
• Tests cover auth, validation, board write, queue, and job execution.

[lexi-chief-of-staff]

Ship it.

• Controller now correctly gates on (issue|brief|kind), emits 202, and hands off to DispatchKitWork instead of synchronous Mattermost post.
• New job isolates the hallway receipt; tests cover the happy path, empty input, kind-only, and DM skip.
• README, boardId logic, and nullable issueNumber all updated consistently.
• No correctness, safety, or test gaps that block merge. CI and queue worker noted in the plan will catch runtime wiring.