feat(management): add GET /management/data-sources flat list endpoint with latest_sync_run

[jsell-rh]

What & Why

The sidebar layout in src/dev-ui/app/layouts/default.vue shows a count badge on
the "Data Sources" nav item indicating how many data sources currently have an active
sync in progress. This satisfies the spec's Navigation Structure requirement:

Data — Knowledge Graphs, Data Sources (with sync status)

The badge implementation calls:

const result = await apiFetch<{ data_sources: Array<{ latest_sync_run?: { status: string } }> }>(
  '/management/data-sources'
)

However, GET /management/data-sources does not exist in the Management API.
The only data-sources list endpoint is GET /management/knowledge-graphs/{kg_id}/data-sources
(scoped to a single KG). The sidebar silently catches the 404 and shows no badge
(activeSyncCount stays 0), so the "(with sync status)" clause is never satisfied.

This PR adds the missing flat list endpoint scoped to the authenticated user's tenant,
with an embedded latest_sync_run object so the badge works with a single API call.

Spec Requirements Satisfied

Requirement: Navigation Structure — Scenario: Primary navigation from
specs/ui/experience.spec.md@e77913c2cc6d8b719291e2dbb6870519a94d50da:

GIVEN an authenticated user
THEN the sidebar presents navigation grouped as:

• Data — Knowledge Graphs, Data Sources (with sync status)

The "(with sync status)" clause requires the sidebar nav item to reflect live sync
state. Without a working backend endpoint, the badge always shows 0 and the clause fails.

Requirement: Backend API Alignment — Scenario: Resource operations succeed end-to-end:

THEN the corresponding backend API call succeeds (2xx response)

The sidebar currently calls a non-existent endpoint (returns 404). Making it return
2xx satisfies this scenario for the sidebar's implicit read operation.

Key Design Decisions

• New route GET /management/data-sources: Returns all data sources accessible
  to the current user in their tenant, across all knowledge graphs. Access is inferred
  from SpiceDB VIEW permission on the parent knowledge graph (same pattern as the
  existing KG-scoped list route).

• Embedded latest_sync_run: A new DataSourceWithSyncResponse model wraps
  DataSourceResponse and adds an optional latest_sync_run: SyncRunResponse | None
  field. This avoids N+1 API calls from the sidebar and is the shape the frontend
  already expects.

• No pagination (V1): The sidebar only needs the status of active syncs, not
  full pagination. Returns all data sources in the tenant. If tenant scale becomes
  an issue, pagination can be added in a follow-up.

• Authorization: Only data sources belonging to knowledge graphs the user has
  VIEW permission on are returned — consistent with existing KG authorization patterns.

• TDD first: Unit tests for the service method, integration tests for the route,
  before any implementation.

Files Affected

• src/api/management/application/services/data_source_service.py — add
  list_all_for_user(user_id) method that fetches all KGs the user can see, then
  all data sources for each, plus the latest sync run per data source.
• src/api/management/presentation/data_sources/models.py — add
  DataSourceWithSyncResponse model with embedded latest_sync_run.
• src/api/management/presentation/data_sources/routes.py — add
  GET /data-sources route (no KG prefix) returning
  { data_sources: list[DataSourceWithSyncResponse], count: int }.
• src/api/tests/unit/management/test_data_source_service.py — add unit tests
  for list_all_for_user.
• src/api/tests/integration/management/test_data_sources_routes.py — add
  integration test for the new route.
• src/dev-ui/app/layouts/default.vue — update fetchActiveSyncCount to handle
  the response type correctly (response is { data_sources: [...] }, not an array).
  Also align the active status set: use 'ai_extracting' not 'extracting' (task-042
  fixes the status labels; this endpoint should emit the canonical backend values).

How to Verify

1. make test-unit — new unit tests for list_all_for_user pass green.
2. make instance-up && make test-integration — new route integration tests pass.
3. Call GET /management/data-sources with a valid API key while a sync is in progress
   — verify the response includes latest_sync_run with an active status.
4. Open the dev UI with an active sync in progress — verify the Data Sources nav item
   shows a numbered badge (e.g., "1").
5. When all syncs are completed or failed, verify the badge disappears.

TDD Cycle

1. Write unit tests for list_all_for_user (RED).
2. Implement list_all_for_user in the data source service (GREEN).
3. Write integration test for GET /management/data-sources (RED).
4. Add the route and DataSourceWithSyncResponse model (GREEN).
5. Update the default layout to remove the silent failure (GREEN for sidebar test).
6. make test-unit && make test-integration exits 0.

Caveats

• This endpoint is additive; no existing routes are changed.
• latest_sync_run is the most recent run ordered by created_at DESC. If a data
  source has never synced, latest_sync_run is null.
• The sidebar's active status set must use 'ai_extracting' not 'extracting'
  (the backend canonical value). The status set in default.vue already uses
  'ai_extracting' (ACTIVE_SYNC_STATUSES constant), so no frontend change is needed
  beyond typing alignment.

---

Task: task-078
Spec: specs/ui/experience.spec.md@e77913c2cc6d8b719291e2dbb6870519a94d50da

Merge

The orchestrator will squash-merge this PR automatically
once all pipeline steps pass.

---

This PR was created by hyperloop,
an AI agent orchestrator.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: a0b78b1a-5c64-478e-a650-818607f182d7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hyperloop/task-078

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}