feat(discovery): Phase 2 — reporter, /api/discovery/* routes (strict loopback-only) + dashboard UI (#5939)

* feat(discovery): Phase 2 reporter — discoveryResults DB module + service wiring

Adds src/lib/db/discoveryResults.ts (CRUD over the discovery_results table
from migration 074) and wires the opt-in discovery service to persist and read
findings through it: persistDiscoveryResult / getDiscoveryResults /
getDiscoveryResultById / markVerified / deleteDiscoveryResult, with
(provider, method, endpoint) upsert de-duplication. Re-exported from localDb.

The service stays opt-in / default-off. The /api/discovery/* routes and the
dashboard UI tab are intentionally deferred to Phase 2b — they need the
local-only enforcement model (Hard Rules #15/#17 territory) decided first.

TDD: tests/unit/db/discovery-results.test.ts (8 cases, DB + service delegation),
isolated DATA_DIR with resetDbInstance cleanup.

* feat(discovery): Phase 2b — /api/discovery/* routes (strict loopback-only)

Adds the discovery HTTP surface on top of the reporter DB module:
  GET    /api/discovery/results            list findings (optional ?providerId)
  GET    /api/discovery/results/:id        one finding (404 if absent)
  DELETE /api/discovery/results/:id        delete a finding
  POST   /api/discovery/scan               scan a provider + persist findings
  POST   /api/discovery/verify/:id         mark a finding verified

Authorization: strict loopback-only. "/api/discovery/" is added to
LOCAL_ONLY_API_PREFIXES so the central authz pipeline (proxy.ts →
runAuthzPipeline → managementPolicy) rejects non-loopback callers with a 403
LOCAL_ONLY before any handler runs. It is deliberately NOT in
LOCAL_ONLY_MANAGE_SCOPE_BYPASS_PREFIXES — no remote manage-scope bypass —
because POST /scan issues outbound probes to provider endpoints (SSRF-adjacent)
and must never be tunnel-reachable. Handlers also call requireManagementAuth
(defense in depth) and return sanitized errors via createErrorResponse.

Tests:
- tests/unit/authz/discovery-routes-local-only.test.ts (8) — security guard:
  isLocalOnlyPath true + not manage-scope-bypassable for all four paths.
- tests/unit/api/discovery-routes.test.ts (6) — handler integration over an
  isolated DATA_DIR: list/filter, by-id 200/404/400, scan persist + 400 on
  empty/malformed body, verify 200/404, delete 200/404, no stack-trace leak.

* feat(discovery): Phase 2c — dashboard UI tab (Tools → Discovery)

Adds the /dashboard/discovery page (DiscoveryPageClient) that consumes the
Phase 2b /api/discovery/* routes: scan a provider, list findings, verify or
delete them. Registered in the sidebar under the Tools group (icon
travel_explore) and given a "discovery" i18n namespace + sidebar keys in
en.json (other locales fall back to en via next-intl until synced — the
locale files are in a pre-existing coverage deficit unrelated to this change).

Registers the UI test path in vitest.config.ts (advisory ui suite).

Tests: src/app/(dashboard)/dashboard/discovery/__tests__/DiscoveryPageClient.test.tsx
(3 cases: loads+renders results, empty state, fetches /api/discovery/results on
mount; stable useTranslations mock to avoid the fetch-loop). NOTE: the ui vitest
suite cannot run in this workspace — @testing-library/dom (a @testing-library/
react peer dep) is absent from node_modules, which fails ALL existing ui tests
equally; the test runs in CI. Component verified locally via typecheck + lint.

* test(discovery): register discovery-routes-local-only in stryker tap.testFiles

The mutation-test-coverage gate (--strict) flags any unit test covering a
mutated module that isn't listed in stryker.conf.json tap.testFiles. This PR's
tests/unit/authz/discovery-routes-local-only.test.ts covers src/server/authz/
routeGuard.ts (a mutated module, which this PR edits by adding the
/api/discovery/ local-only prefix), so it must be registered for its mutant
kills to count. No behavior change.

* refactor(discovery): split DiscoveryPageClient to satisfy max-lines-per-function

The complexity ratchet (max-lines-per-function: 80) flagged the single
184-line DiscoveryPageClient function (+1 over baseline). Extract the data
layer into two hooks (useDiscoveryResults for list/loading/feedback,
useDiscoveryActions for scan/verify/delete), a shared callApi helper, and two
presentational sub-components (DiscoveryScanForm, DiscoveryResultCard). Every
function is now under the 80-line ceiling; complexity gate back to baseline
1995. No behavior change — same exported component, same endpoints, same props.

* test(sidebar): include discovery in omni-proxy item-order snapshot

Adding the Discovery item to the Tools group (this PR's sidebar entry) extends
the ordered omni-proxy section list. Update the exact-match deepEqual snapshot
in sidebar-visibility.test.ts to include "discovery" in its position (after
traffic-inspector). The assertion stays exact — this reflects the intentional
new item, it does not weaken the check.

* docs(changelog): restore release bullets eaten by merge auto-resolve; re-add discovery bullet additively

* chore(quality): bump testFrozen for translator-openai-responses-req.test.ts (1097 -> 1172)

Base-red inherited from #5933, which grew the test file to 1171 lines
(Hard Rule #18 regression tests) without adjusting the frozen cap. The
release tip itself fails check:file-size; this unblocks every PR into
release/v3.8.44. File untouched by this PR.

* chore(quality): restore stryker tap.testFiles entries eaten by merge auto-resolve

The merge of origin/release/v3.8.44 silently dropped the 3 entries added
on the release side (#5903, clinepass, #5923). Took the release version
verbatim and re-added only this PR's entry (discovery-routes-local-only)
in alphabetical order. check:mutation-test-coverage green locally.

* chore(quality): reconcile inherited v3.8.44 merge-burst drift + include discovery in tools-group order test

- complexity 1995->2003 and cognitive 856->859: both measure IDENTICAL on
  the pristine release tip (3a3d618fe) and this PR's merged HEAD — the PR
  is complexity-net-zero; drift is from the 2026-07-02 merge burst
  (notes added to both baselines, same family as prior reconciliations).
- sidebar-tools-group.test.ts: append 'discovery' to the expected
  TOOLS_GROUP order — the intentional new sidebar item this PR adds
  (same expected-value update already made in sidebar-visibility.test.ts).

src/app/api/discovery/results/[id]/route.ts

@@ -0,0 +1,62 @@
+/**
+ * Discovery result by id — GET / DELETE /api/discovery/results/:id
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../route.ts for the model).
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { getDiscoveryResultById, deleteDiscoveryResult } from "@/lib/db/discoveryResults";
+
+function parseId(raw: string): number | null {
+  const id = Number(raw);
+  return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = parseId(rawId);
+  if (id === null) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const result = getDiscoveryResultById(id);
+    if (!result) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ result });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to read discovery result");
+  }
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = parseId(rawId);
+  if (id === null) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const removed = deleteDiscoveryResult(id);
+    if (!removed) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ deleted: true, id });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to delete discovery result");
+  }
+}

src/app/api/discovery/results/route.ts

@@ -0,0 +1,29 @@
+/**
+ * Discovery results — GET /api/discovery/results
+ *
+ * Lists persisted discovery findings, optionally filtered by `?providerId=`.
+ *
+ * Auth: Tier 3 MANAGEMENT (requireManagementAuth) + strict local-only. The
+ * `/api/discovery/` prefix is in `LOCAL_ONLY_API_PREFIXES` (routeGuard.ts), so
+ * the central authz pipeline (src/proxy.ts → runAuthzPipeline → managementPolicy)
+ * blocks non-loopback callers with a 403 LOCAL_ONLY before this handler runs.
+ * It is NOT in the manage-scope bypass list — strict loopback, no remote bypass.
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { getDiscoveryResults } from "@/lib/db/discoveryResults";
+
+export async function GET(request: Request): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  try {
+    const url = new URL(request.url);
+    const providerId = url.searchParams.get("providerId") || undefined;
+    const results = getDiscoveryResults(providerId);
+    return Response.json({ results });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to list discovery results");
+  }
+}

src/app/api/discovery/scan/route.ts

@@ -0,0 +1,54 @@
+/**
+ * Discovery scan — POST /api/discovery/scan
+ *
+ * Triggers a scan for one provider and persists the findings. Body:
+ * `{ "providerId": "<id>" }`.
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../results/route.ts). The
+ * strict-loopback classification matters here specifically: `scanProvider` may
+ * probe outbound provider endpoints (SSRF-adjacent), so the surface must never
+ * be reachable from a tunnel/remote origin.
+ */
+
+import { z } from "zod";
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
+import { scanProvider, persistDiscoveryResult } from "@/lib/discovery/index";
+
+const scanRequestSchema = z.object({
+  providerId: z.string().min(1).max(200),
+});
+
+export async function POST(request: Request): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  let raw: unknown;
+  try {
+    raw = await request.json();
+  } catch {
+    return createErrorResponse({
+      status: 400,
+      message: "Invalid request",
+      details: [{ field: "body", message: "Invalid JSON body" }],
+    });
+  }
+
+  const validation = validateBody(scanRequestSchema, raw);
+  if (isValidationFailure(validation)) {
+    return createErrorResponse({
+      status: 400,
+      message: validation.error.message,
+      details: validation.error.details,
+    });
+  }
+
+  try {
+    const found = await scanProvider(validation.data.providerId);
+    const persisted = found.map((result) => persistDiscoveryResult(result));
+    return Response.json({ results: persisted });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to scan provider");
+  }
+}

src/app/api/discovery/verify/[id]/route.ts

@@ -0,0 +1,35 @@
+/**
+ * Discovery verify — POST /api/discovery/verify/:id
+ *
+ * Marks a discovery finding as verified (status='verified', stamps verified_at).
+ *
+ * Auth: Tier 3 MANAGEMENT + strict local-only (see ../../results/route.ts).
+ */
+
+import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
+import { createErrorResponse, createErrorResponseFromUnknown } from "@/lib/api/errorResponse";
+import { markVerified } from "@/lib/db/discoveryResults";
+
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+): Promise<Response> {
+  const authError = await requireManagementAuth(request);
+  if (authError) return authError;
+
+  const { id: rawId } = await params;
+  const id = Number(rawId);
+  if (!Number.isInteger(id) || id <= 0) {
+    return createErrorResponse({ status: 400, message: "Invalid discovery result id" });
+  }
+
+  try {
+    const result = markVerified(id);
+    if (!result) {
+      return createErrorResponse({ status: 404, message: "Discovery result not found" });
+    }
+    return Response.json({ result });
+  } catch (error) {
+    return createErrorResponseFromUnknown(error, "Failed to verify discovery result");
+  }
+}