fix(apiserver): apikeys whitelist + job_status type + mcp_operator queue:control

Three fixes found during scheduler-agent Phase 1 cluster verification:

- whitelist.go: add /xce/v1/apikeys to WhitelistPOSTURL (Phase 0 added the
  route but never whitelisted it → 403 "URL is not allowed"). bug-1489.
- jobs.go: fix job_status int64 assertion in job control. store.Jobs returns
  status as int/float64; the `.(int64)` assertion broke control with
  "job_status is not an int64". Add normalizeJobStatus() accepting int/int32/
  int64/float64/json.Number.
- rbac.yaml: mcp_operator role gains queue:control (the job-control handler
  also checks queue:control on the job's queue); add rbac_mcp_operator_test.

Co-Authored-By: Claude <noreply@anthropic.com>

src/frontend/apiserver/middleware/whitelist.go

@@ -36,6 +36,7 @@ var WhitelistGETURL = []string{
 var WhitelistPOSTURL = []string{
 	"/xce/v1/auth/logon",     // logon
 	"/xce/v1/auth/logout",    // logout
+	"/xce/v1/apikeys",        // generate service-account API key (Phase 0)
 	"/xce/v1/hosts/control",  // control hosts
 	"/xce/v1/hosts/select",   // filter host with -R select string
 	"/xce/v1/queues/control", // control queues