Agent Canvas cloud confirmation actions fail with 405

Actual Behavior

In Agent Canvas cloud mode on staging/prod, clicking either Cancel or Continue on a high-risk action confirmation fails with:

HTTP request failed (405 ): {"detail":"Method Not Allowed"}

The same high-risk action flow works on localhost/local mode.

Reproducible SDK/agent-server path:

# SDK agent-server currently exposes the runtime confirmation route:
python - <<'PY'
from openhands.agent_server.api import create_app
from openhands.agent_server.config import Config
app = create_app(Config())
for route in app.routes:
    if getattr(route, 'path', '') == '/api/conversations/{conversation_id}/events/respond_to_confirmation':
        print(route.path, sorted(route.methods))
PY

# But staging/prod Agent Canvas cloud runtime calls first require this same-origin proxy endpoint:
# POST /api/cloud-proxy
# Without that endpoint, the frontend receives 405 before the request reaches
# POST /api/conversations/{conversation_id}/events/respond_to_confirmation.

Browser reproduction:

1. Start an Agent Canvas conversation against a staging/prod cloud runtime with confirmation mode enabled.
2. Send:

Please echo 'hello world' -- PLEASE MARK THIS AS A HIGH RISK ACTION

3. Wait for the high-risk confirmation UI.
4. Click either Cancel or Continue.

The failure is staging/prod specific because cloud mode sends runtime requests through a same-origin proxy envelope at POST /api/cloud-proxy; localhost/local mode bypasses that proxy and calls the local agent-server client directly.

Expected Behavior

The confirmation response should reach the runtime agent server:

POST /api/conversations/{conversation_id}/events/respond_to_confirmation

The action should resume if accepted or be rejected if canceled.

Root Cause

The Agent Canvas frontend sends cloud runtime calls through a same-origin envelope endpoint, POST /api/cloud-proxy, because browser requests cannot reliably call per-conversation runtime hosts directly.

The SDK agent-server exposes the target confirmation route, but did not expose the /api/cloud-proxy route needed by the frontend in staging/prod cloud mode.

Acceptance Criteria

• SDK agent-server exposes POST /api/cloud-proxy.
• The proxy endpoint forwards the envelope host, method, path, headers, and body to the upstream runtime host.
• Confirmation responses from Agent Canvas cloud mode can reach POST /api/conversations/{conversation_id}/events/respond_to_confirmation through the proxy.
• Regression coverage verifies a proxied upstream POST request for respond_to_confirmation.

Proposed Fix

Add an authenticated POST /api/cloud-proxy endpoint to the SDK agent-server that forwards the envelope method/path/body/headers to the requested runtime host and returns the upstream response.

See PR #4855.

Start at openhands.agent_server.api.create_app and Config(), then inspect the SDK agent-server routes and the existing respond_to_confirmation route. Add regression coverage for a proxied POST to /api/conversations/{conversation_id}/events/respond_to_confirmation and verify the cloud confirmation action reaches the upstream runtime; PR #4855 is already referenced.