When AI Agents Look Like Legitimate Users​: A Framework for Traffic Visibility and Control