feat(console): named PAKs, zero-config UI auth, and tenant-scoped views (BROKKR-I-0032)

[dylanbstorey]

Summary

Implements BROKKR-I-0032: the operator console now works with zero configuration and can scope every data view to a single tenant.

Design decision (approved): tenants ARE generators — no new PAK table. The scope selector lists named generators; filtering rides stacks.generator_id and agent_generator_registrations (ADR-0009 tenancy).

Broker

• Ephemeral read-only UI PAK (utils/ui_pak.rs): minted per process, in-memory only. Middleware treats it as a readonly admin; non-GET requests get 403, with POST /auth/pak and diagnostics creation allowlisted.
• Token injection (api/assets.rs): served index.html carries <meta name="brokkr-ui-token"> (+ Cache-Control: no-store) — the console authenticates with no operator setup.
• GET /api/v1/paks: slim [{id, name}] tenant listing (non-system generators), admin-gated.
• ?pak_id= scoping on GET /fleet, /stacks, /agent-events — SQL-side filtering; unknown id → empty list, malformed → 400. View filter, not an auth boundary (initiative non-goal).
• Audit enrichment: /admin/audit-logs entries carry a resolved actor_name (batched name lookups, no N+1).

Console (brokkr-web)

• Boots from the injected token; localStorage["brokkr_pak"] stays as the write-capable override.
• Tenant selector in the sidebar ("All" + named PAKs), persisted in localStorage["brokkr_scope"]; Fleet/Deployments/Telemetry/Overview refetch reactively.
• Bug found during verification & fixed: gloo-net appends a stray trailing & to URLs that already have a query string — pak_id now attaches via the builder's .query() API.

Tooling & release

• Playwright harness: two-tenant fixtures, scope-selector and fleet-scoped scenes, query-aware mock routing.
• OpenAPI spec + Python/TypeScript SDK clients regenerated (drift checks pass).
• Version bump 0.8.3 → 0.8.4 (lockstep: all crates, both charts, all SDKs).

Verification

• angreal tests unit brokkr-broker: 120 passed
• angreal tests integration brokkr-broker: 484 passed, 0 failed (new: ui_pak ×5, paks ×3, pak_scoping ×3, audit enrichment)
• angreal openapi check / check-python / check-typescript: no drift
• Console wasm + trunk build --release clean; 16 Playwright scenes regenerated and visually verified
• Live end-to-end demo: token injection, dropdown from /paks, server-side scoping, 403 on writes with the UI token

Notes

• Known pre-existing gap (unchanged, tracked on BROKKR-T-0273): the Fleet "Run diagnostic" button targets /api/v1/diagnostics, which has never existed broker-side.
• Full metis record: .metis/initiatives/BROKKR-I-0032/.

https://claude.ai/code/session_0182KcANrkLy1g5sFyJHaYGz