feat: SDK-driven pipeline + plain-HTTP frontend, with PR-gating CI hardening

[petrpan26]

What

End-to-end clean state for pip install beava users. The bv.dev homepage now uses the SDK's wire format end-to-end — no shim layer, no bucket-field sentinel, no JS client SDK on the frontend.

First PR woo testing some flow.

Pipeline

@bv.event
class PageView:
    path: str
    dwell_ms: int

@bv.table              # no key= → one global row, ADR-003
def SiteMetrics(e: PageView):
    return e.agg(
        site_med_dwell_1h = bv.quantile(e.dwell_ms, q=0.5, windowed="1h"),
        site_views_today  = bv.count(windowed="24h"),
        site_views_1h     = bv.count(windowed="1h"),
    )

Wire (what flies on the network)

• Push: POST /api/push/PageView with {path, dwell_ms}. Pure HTTP from the browser, no SDK shim.
• Read: POST /api/get with {table: "SiteMetrics", key: ""} — empty-key sentinel for the keyless table per ADR-003.
• Register: SDK emits {nodes: [{kind:"event"...}, {kind:"derivation"...}]} and POSTs to /register. The binary on the box accepts it natively.

Hetzner deployment changed (live)

• deploy/Dockerfile.beava — builds beava:next from crates/* workspace.
• beava-website/deploy/{beava.yaml, docker-compose.prod.yml, Caddyfile} — yaml-driven config (listen 8080, admin 8090), drops the env-var soup, drops the admin-token Authorization injection.
• beava-website/deploy/site-metrics-pipeline.json — registered shape, re-runnable for cold-start.

Frontend

• beava-website/project/js/track-pageview.js — pure HTTP, ~30 lines, no shim.
• beava-website/project/js/beava-client.js — deleted. We tried it, then dropped it once the binary upgrade let the frontend talk plain HTTP.
• beava-website/project/index.html — LiveMetrics polls POST /api/get for the global SiteMetrics row.

Verified

$ curl -X POST https://beava.dev/api/get -d '{"table":"SiteMetrics","key":""}'
{"site_med_dwell_1h":7400.0,"site_views_1h":17,"site_views_today":17}

Followups (separate)

• Top-page card stub: pipeline can grow a per-path PageMetrics derivation once feature names are namespaced.
• Wipe pre-v2 snapshot from beava-website_beava-state volume (still has old format data hanging around).
• Tag a v0.0.0 to fire the homebrew-bump workflow.