feat: Phase 5b — dashboard for tenants and platform operators

[TheMeinerLP]

Note: This replaces #15, stacked on clean2/phase-5-api instead of clean/phase-5-api. Same content otherwise.

Replaces #7, closed. Same content, rebuilt as a single squash commit on clean/phase-5b-ui because a secret scanner flagged disposable test credentials in the old commit history and history cannot be rewritten in this environment. See the closing comment on #7 for detail.

Phase 5b of Apus: the dashboard. Stacked on PR #6.

Nuxt 4 in SPA mode, Vue 3, Tailwind 4, Nuxt UI — matching the launchpad house standard. Two levels, separated by the role in the token: tenants manage their own sources, maps, renders and hosting; platform operators manage tenants, quotas and allowed domains.

Two things done deliberately

Frontend role checks are convenience, not security. The dashboard hides what a role may not do, but enforcement stays in the API. Nothing here is built to look like the frontend enforces rights — that invites dropping the server-side check later.

Progress is displayed honestly. Telemetry can degrade without the render being at risk; the API then reports -1 and degraded: true. The UI says so instead of drawing a bar at zero or inventing a value. That distinction is why phase 1 has a contract test in the first place.

Tokens live in memory only — not localStorage, not sessionStorage. A bearer JWT in Web Storage is scrapable by any XSS for as long as it sits there. Cost: a hard reload drops it, covered by silent renewal against the broker's own session.

Bugs found while building

A runtime error in the shared layout. Nuxt registers components from subdirectories with a directory prefix, so components/layout/AppHeader.vue is LayoutAppHeader in templates. The layout referenced <AppHeader />, which compiles to a resolveComponent that fails at runtime — and neither vue-tsc nor nuxt build reports it. Both parallel agents hit this independently.

It is now guarded by a test that actually mounts the layout and fails if a component does not resolve. That guard was itself validated: the fix was reverted, the test failed exactly as the original bug manifested, then the fix was restored. A typecheck demonstrably does not catch this.

Two API gaps that made the platform level unusable. There was no way to change an existing tenant's quota (only GET and POST /api/tenants), and no cluster-wide view of running renders — GET /api/renders always resolves the namespace from the caller's own tenant. Both contradict spec §10.3, which grants platform-admin exactly those abilities. The agent surfaced them as visible notices rather than faking a working screen, and both are now implemented.

The cluster-wide endpoint is the one place in the API that crosses tenant boundaries, so it is hard-restricted to platform-admin with a test proving every other role is refused. That kind of endpoint is precisely the hole that had to be closed three times already, in phases 2a, 3 and 5a.

Testing

107 frontend tests plus lint, typecheck and a production build with a runtime smoke test; API tests green including the new endpoints.

Known gaps

• The OIDC flow has never run against a real broker — none is deployed yet (spec §15 still open).
• The cluster-wide render table shows a snapshot with a refresh button; the live SSE streams stayed tenant-scoped.
• Editing a tenant covers quota and allowed domains, not the display name.