fix: remove gzip middleware from agent endpoints

[kmendell]

Checklist

• This PR is not opened from my fork’s main branch

What This PR Implements

Fixes: #2626

Fixes: #2625

Changes Made

Testing Done

• Development environment started: ./scripts/development/dev.sh start
• Frontend verified at http://localhost:3000
• Backend verified at http://localhost:3552
• Manual testing completed (describe):
• No linting errors (e.g., just lint all)
• Backend tests pass: just test backend

AI Tool Used (if applicable)

AI Tool:
Assistance Level:
What AI helped with:
I reviewed and edited all AI-generated output:
I ran all required tests and manually verified changes:

Additional Context

Disclaimer Greptiles Reviews use AI, make sure to check over its work.

To better help train Greptile on our codebase, if the comment is useful and valid Like the comment, if its not helpful or invalid Dislike

To have Greptile Re-Review the changes, mention greptileai.

Greptile Summary

This PR fixes gzip-related issues with agent/proxy endpoints by removing the Echo gzip middleware from the /api route group entirely and suppressing the Accept-Encoding header when the manager proxies requests to remote agents.

• router_bootstrap.go: Drops the echomiddleware.GzipWithConfig call that applied level-5 compression to all /api responses. The previous skipper only excluded WebSocket/streaming paths; removing the middleware globally eliminates gzip interference on HTTP/2 and agent tunnels.
• remenv.go: Adds Accept-Encoding to GetSkipHeaders() so the proxy never asks remote agents to compress their responses, preventing the manager from receiving opaque compressed payloads it cannot decode.
• Tests: A new H2C integration test (TestHTTP2APIResponsesDoNotUseAPIGzipInternal) validates the fix end-to-end against a live server; remenv_test.go adds a corresponding assertion for the new skip entry.

Confidence Score: 5/5

Safe to merge — the changes are minimal, well-scoped, and backed by a real H2C integration test.

Both changes are small and targeted: the gzip middleware removal is a single apiGroup.Use(...) deletion, and the Accept-Encoding skip is a one-line map entry addition. The new integration test exercises the actual fix against a real server, and the existing test suite gains a matching assertion. No logic paths, auth flows, or data models are touched.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix: remove gzip middleware from agent e..." | Re-trigger Greptile}

[kmendell]

• fix: remove gzip middleware from agent endpoints #2627 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[getarcaneappbot]

Container images for this PR have been built successfully!

• Manager: ghcr.io/getarcaneapp/arcane:pr-2627
• Agent: ghcr.io/getarcaneapp/arcane-headless:pr-2627

Built from commit 8c6a111

[fubar-coder]

Thanks for the quick turnaround! One observation for the future, in case gzip
support is re-introduced later: the new TestHTTP2APIResponsesDoNotUseAPIGzipInternal
guards the current fix (gzip is off), but wouldn't catch the actual underlying
bug class (Content-Length not matching the wire body when gzip is on).

If/when compression comes back, a companion test that enables gzip and asserts
declared Content-Length == actual bytes on wire would catch RFC 9113 §8.1.1
violations directly — independent of which middleware library is used. Something
like:

  resp := http2Get(server, "/api/foo", "Accept-Encoding: gzip")
  require.Equal(t,
      atoi(resp.Header.Get("Content-Length")),
      len(rawBody),  // BEFORE decompression
      "Content-Length must match wire bytes per RFC 9113 §8.1.1",
  )

Not a blocker for this PR — just noting it so the property is captured somewhere
when this gets revisited.