perf/docs: observe routing-panel timings and append UAT audit evidence

[yangshu2087]

Summary

• add CI observability for /app bootstrap that includes the new /usage/summary routing panel request
• keep Web required checks contract unchanged while enriching Actions summary with bootstrap/scenario timing signals
• append audit-traceable UAT evidence (API live smoke + frontend real-browser visual pass) to the tracked UAT report
• prioritize Codex OAuth local routing and reduce local-model memory footprint by default (Ollama opt-in only)

What changed

• CI/perf instrumentation:
  • apps/web/scripts/run-playwright-ci.mjs
  • apps/web/e2e/ordinary-user-ci.spec.ts
  • .github/workflows/ci.yml
• Routing defaults + fallback policy (new):
  • apps/api/src/common/model-gateway.service.ts
  • .env.example
  • apps/api/test/model-gateway.test.ts
• Audit docs closure:
  • output/reports/uat-full/UAT-LOCAL-BUILTIN-BROWSER-2026-04-17.md

UAT evidence references (for audit traceability)

• API smoke section:
  • Session 2026-04-18 08:20 PDT — minimal API live smoke (/health + protected route)
  • Session 2026-04-20 07:08 PDT — full ordinary-user rerun ... + same-session API smoke
• Frontend visual section:
  • Session 2026-04-18 08:23 PDT — frontend visual evidence refresh (docs-only closure)
  • Session 2026-04-20 07:22 PDT — realtime home-page screenshot evidence supplement
• Files:
  • output/reports/uat-full/UAT-LOCAL-BUILTIN-BROWSER-2026-04-17.md
  • output/reports/uat-full/BAOYU-ORDINARY-USER-SYNC-2026-04-20_06-53-27.md

Backend/API lane notes (for reviewers)

• API contract unchanged (/v3/* unchanged); this pass only adjusts model candidate ordering and provider enablement defaults.
• Error semantics unchanged (/usage/summary remains 401 UNAUTHORIZED without Bearer token).
• Permission boundary unchanged (authorized token required for protected usage endpoints).
• Data consistency unaffected (no schema contract change; routing + env default behavior only).
• Targeted regression:
  • pnpm --filter @draftorbit/api exec tsx --test test/model-gateway.test.ts (12/12 pass)
  • pnpm --filter @draftorbit/api typecheck (pass)

Verification

• Local:
  • pnpm --filter @draftorbit/web test
  • pnpm --filter @draftorbit/web typecheck
  • pnpm --filter @draftorbit/web build
  • pnpm --filter @draftorbit/api exec tsx --test test/model-gateway.test.ts
  • pnpm --filter @draftorbit/api typecheck
  • API live smoke (/health, /usage/summary unauthorized + authorized)
  • ui-browser-verify real browser pass (375/768/1024/1440 screenshots, errors.txt empty)
• GitHub Actions:
  • CI run on this branch succeeded: Web required checks

[yangshu2087]

审计补充（Actions 完成后回填）✅

1) Final check 结果（head: dc26d41）

• Web required checks: PASS
  • https://github.com/yangshu2087/draftorbit/actions/runs/24607810275
  • https://github.com/yangshu2087/draftorbit/actions/runs/24607819265

2) CI 时序关键指标（最新 run: 24607819265）

• app bootstrap（含 /usage/summary panel）采样：1.85s / 2.09s / 1.07s
  • max = 2.09s（<= 2.5s watch 目标 ✅）
• Playwright reporter time：10.2s
  • 仍满足 required hard budget（12s）✅
  • 对 10s watch 目标有轻微超出（持续观察项）⚠️
• harness wall time：17.28s

3) API smoke 证据（后端链路）

见 UAT 文档章节：

• Session 2026-04-18 08:20 PDT — minimal API live smoke (/health + protected route)
• 文件：output/reports/uat-full/UAT-LOCAL-BUILTIN-BROWSER-2026-04-17.md

要点回放：

• GET /health → 200 OK（live/ready/dependencies 正常）
• GET /usage/summary（无 token）→ 401 UNAUTHORIZED
• GET /usage/summary（Bearer token）→ 200 OK，返回 workspace-scoped summary + routing observability 字段

4) Visual evidence 证据（前端链路）

见 UAT 文档章节：

• Session 2026-04-18 08:23 PDT — frontend visual evidence refresh (docs-only closure)
• 同文件：output/reports/uat-full/UAT-LOCAL-BUILTIN-BROWSER-2026-04-17.md

要点回放：

• 本地首页真实浏览器加载通过：http://127.0.0.1:3300/
• 断点截图：375 / 768 / 1024 / 1440
• errors.txt 为空（无前端 runtime error）

---

Reviewer 可直接从上述 UAT 章节定位「API + Visual」双链路审计证据。