Add Flowise Sentinel QVC cockpit bridge with Node 22 compatibility

[fonminer]

Summary

• Add a Flowise Sentinel/QVC cockpit bridge under /sentinel-cockpit.
• Keep browser traffic same-origin to Flowise cockpit routes.
• Add server-held Gateway bridge paths for classify, plan decision, manual packet preparation, and result review behind explicit environment flags.
• Add display-only cockpit UI for goal intake, route guidance, plan decision, manual packet readiness, and sanitized result review verdicts.
• Add Node 22 local toolchain compatibility and native prebuild lockfile support in a separate commit.

Node Baseline

• Node 22 is intentional for this draft PR.
• Node 24 is not adopted here.
• Source behavior and Node/toolchain compatibility are kept as separate commits in this one draft PR:
  • f8ed65e feat: add Flowise QVC cockpit bridge
  • 2721699 chore: add Node 22 toolchain compatibility

Safety Boundaries

• No browser-direct Gateway access.
• No worker launch, shell, MCP, Agentflow/HITL, repo write, commit, publish, deploy, or hidden execution UI.
• No raw Gateway token, IDs, approval challenge, cockpit/client nonce refs, task packets, copyable worker prompt, raw result packet, DTOs, or evidence manifests displayed.
• allowed_user_actions returns to [none] after result review.
• Generated server dist and UI build outputs are not included.

Validation

• Dependency install under Node 22 passed.
• Server cockpit tests: 83 passed.
• UI/API cockpit tests: 109 passed.
• Ordered component/server/UI build readiness passed.
• Server route-mount build/readiness passed.
• Packaged local runtime smoke passed the full QVC loop with browser direct Gateway calls at 0.

Notes

This PR is opened as a draft so the source behavior and Node 22/toolchain baseline can be reviewed together while remaining separated by commit.

[gemini-code-assist]

Code Review

This pull request introduces the 'Sentinel Cockpit' feature, providing a secure, display-only interface for 'Quality Vibe Coding' within Flowise. The implementation includes backend bridges for intent classification and session resumption, a central controller with rigorous request validation and admission logic, and a comprehensive React UI for managing goals, plans, and manual work results. Additionally, the project's Node.js environment is upgraded to version 22. Feedback highlights several improvement opportunities: enhancing deployment flexibility by making host and gateway origins configurable via environment variables, avoiding global side effects like mutating process.env, adopting standard nullish check idioms, and improving the robustness of request body parsing by handling the aborted event to prevent potential resource leaks.

[fonminer]

Node 22 is intentional in this draft PR; Node 24 is explicitly out of scope for this branch.

I aligned the CI workflow to Node 22 in d62870f (ci: align Flowise checks with Node 22) so the branch validates the same runtime baseline declared by .nvmrc and package engines.

The current GitHub checks are showing as action_required because fork PR workflows need approval before they run.

Local validation already passed before opening the PR:

• Node 22 dependency install
• server cockpit tests: 83 passed
• UI/API cockpit tests: 109 passed
• ordered build/readiness
• packaged runtime smoke full QVC loop

Generated dist/build outputs are intentionally not included.