Add digest-bound role-profile HTTP API and web editor

[Punisheroot]

Summary

Add a bounded, digest-bound HTTP API and local web editor for canonical Codex role profiles.

The control plane can now inspect profile state and revision history, run request-time offline preflight, save drafts, and explicitly activate or deactivate exact revisions without weakening the existing session, CSRF, and optimistic-concurrency boundaries.

Closes #2.

Implementation

• Added authenticated role-profile endpoints for:
  • bounded profile listing and revision detail;
  • revision history and audit summaries;
  • request-time offline preflight;
  • draft creation and revision;
  • explicit activation and deactivation.
• Reused the existing session, same-origin, CSRF, and quoted If-Match handling. Missing and stale digests retain the existing 428 and 412 semantics.
• Added stable needle.role-profiles/1 and needle.role-profile-error/1 response schemas, a 64 KiB request-body limit, and list/history/audit limits of at most 100 records.
• Derived preflight from canonical role-profile validation and WorkerProfile projection. No preflight state is persisted, and activation recomputes preflight immediately before the transition.
• Added bounded store queries for profile states and the latest revision window. Revision audit records now preserve the actual prior active revision and definition digest.
• Added typed React Query hooks and a Codex-only role-profile editor under Models. The editor supports draft creation, revision inspection, stale-state recovery without merging, and activation/deactivation confirmations bound to the exact profile, revision, definition digest, active digest, and state digest.
• Preserved the global ModelPolicy editor as the sole owner of the model ladder.
• Did not change the canonical role-profile domain, SQLite migration, worker/session binding, lifecycle execution, or runtime execution hot path.

Validation

cd crates/needle-app/web
npm ci
PASS — 415 packages installed; npm audit reported 3 high-severity findings in the current dependency tree.

npm test -- --run
PASS — 13 tests across 2 test files.

npm run typecheck
PASS.

npm run lint
PASS.

npm run build
PASS — production assets built successfully.

cd ../../..
cargo build --locked -p needle-app
PASS.

cd crates/needle-app/web
npm run test:e2e:local
PASS — 1 authenticated local control-plane test.
The first attempt timed out because target/debug/needle.exe was absent; after the required Rust build, the unchanged command passed.

cd ../../..
cargo test --locked -p needle-app
PASS — 82 tests.

cargo test --locked -p needle-runtime
PASS — 110 tests.

cargo test --locked -p needle-app --bin needle server::role_profiles::tests
PASS — 4 focused authenticated HTTP tests after the final HTTP error-path correction.

cargo clippy --locked --workspace --all-targets -- -D warnings
PASS — no issues found.

cargo fmt --all -- --check
PASS.

git diff --check
PASS.

Risks/limitations

• Role profiles remain an offline, configuration-only boundary. This change does not launch workers, bind profiles to sessions, execute lifecycle phases or tests, apply patches, or configure non-Codex hosts.
• List, history, audit, and request bodies are deliberately bounded. Revision history uses a bounded indexed SQL window rather than materializing every revision.
• Request-time preflight adds canonical validation and WorkerProfile projection work only to explicit profile requests; it does not affect the execution hot path or persist additional state.
• The local end-to-end entry point verifies the authenticated embedded control plane and navigation. Role-profile lifecycle behavior is covered by focused HTTP and component tests rather than a complete browser-driven lifecycle.
• npm ci currently reports 3 high-severity dependency findings. No automatic audit remediation was applied because it could introduce unrelated or breaking dependency changes; package-lock.json is unchanged.
• No performance benchmark was run, and this change makes no performance improvement claim.
• No migration or backward-incompatible settings/model-policy response change is introduced.

Documentation/evidence

• Updated docs/CONFIGURATION.md with the offline role-profile API/editor boundary.
• Updated docs/RUNTIME_AND_WEB_CONTROL_PLANE.md with endpoints, schemas, bounds, preconditions, and Codex-only capability status.
• Updated PROJECT_STATUS.md to distinguish the implemented HTTP/editor slice from the still-pending session binding and lifecycle execution work.
• Verified that the change contains no credential-shaped values, generated web/dist files, SQLite databases, logs, or live artifacts.

AI assistance and human verification

AI assistance: code only
Human verification: I reviewed the complete diff against issue #2 and the existing role-profile, RuntimeStore, control-plane security, and ModelPolicy boundaries. I inspected the digest and confirmation binding, stale-write behavior, activation-time preflight, bounded queries and payloads, audit provenance, error schemas, frontend query invalidation, documentation, and compatibility impact. I personally verified the validation results listed above and checked the final worktree for unrelated edits, credentials, generated files, and live artifacts.

Ownership checklist

• I read and understand the complete diff and can explain every material change.
• I personally verified the reported tests and technical or performance claims.
• I finalized and personally published the commits and this pull request.
• I checked for unrelated edits, credentials, generated files, and live artifacts.
• Public documentation and PROJECT_STATUS.md are updated when applicable.