feat: choose which probes link to which agents from the admin

The panel decides the probe/agent pairs and probes always dial out. A new
fleet.auto_link setting connects every probe to every agent (default); with it
off only the pairs chosen by hand connect, and any pair can be forced on or
off. The Probes page has a link matrix with the switch and per-pair toggles.

web/shared/api/schema.ts

@@ -851,6 +851,40 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/admin/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Every probe/agent pair: whether it is linked, the manual override and whether it is connected */
+        get: operations["links_list"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/admin/links/{probe_id}/{agent_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Force a link on or off, or give it back to the automatic setting (enabled: null) */
+        put: operations["links_set"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/healthz": {
         parameters: {
             query?: never;
@@ -1250,6 +1284,19 @@ export interface components {
             kinds: string[];
             last_test: null | components["schemas"]["TestSummaryDto"];
         };
+        LinkDto: {
+            probe_id: string;
+            probe_name: string;
+            agent_id: string;
+            agent_name: string;
+            linked: boolean;
+            override: null | boolean;
+            connected: boolean;
+        };
+        LinkMatrixDto: {
+            auto_link: boolean;
+            items: components["schemas"]["LinkDto"][];
+        };
         LocalLimitsDto: {
             /** Format: double */
             max_total_mbps: number | string;
@@ -1594,6 +1641,9 @@ export interface components {
                 [key: string]: string;
             };
         };
+        SetLinkRequest: {
+            enabled: null | boolean;
+        };
         SettingDto: {
             key: string;
             type: string;
@@ -4760,6 +4810,107 @@ export interface operations {
             };
         };
     };
+    links_list: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LinkMatrixDto"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+        };
+    };
+    links_set: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                probe_id: string;
+                agent_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["SetLinkRequest"];
+            };
+        };
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["LinkDto"];
+                };
+            };
+            /** @description Bad Request */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Unauthorized */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Forbidden */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+            /** @description Not Found */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["ProblemDto"];
+                };
+            };
+        };
+    };
     health_get: {
         parameters: {
             query?: never;