feat(dashboard): orchestration canvas fase 2 — repeat action + A2A memory hits (2.6/2.7) (#12508)

* feat(api): conductor task creation route (repeat support)

* feat(a2a): record memoryHits consulted per task (observability, 2.7)

* feat(dashboard): repeat action in orchestration drawer (2.6 — repeat only)

* fix(dashboard): require every field each repeat contract needs before enabling the action

* feat(dashboard): memory-used drawer section + fase2 i18n/changelog (2.7)

* fix(dashboard): validate memoryHits shape before rendering + locale wording fixes

* fix(dashboard,a2a): stop memoryHits leaking into repeats, harden drawer guard + status clamp

Final whole-branch review fix wave for the Orchestration Canvas Fase 2 PR-C.

- a2a: `createTask` stores a COPY of `input.metadata` instead of aliasing it, so the
  observability `memoryHits` written by `executeA2ATaskWithState` no longer leak into
  `task.input.metadata`, into the persisted `a2a_tasks.input_json`, or into the drawer's
  "Repeat" body (a repeated task was born carrying the previous run's memory snippets,
  even with the `OMNIROUTE_A2A_MEMORY_HITS=0` kill-switch on).
- dashboard: `repeatReqFor` strips `memoryHits` from the a2a repeat metadata, so tasks
  persisted before the copy-fix do not propagate them either.
- dashboard: the "Memory used" section now requires all four rendered fields (id, key,
  type, snippet) to be strings — `{ id: "x", key: { a: 1 } }` used to throw "Objects are
  not valid as a React child" and take the whole drawer down.
- dashboard: an `/a2a` action answered with a JSON-RPC error under HTTP 200 is reported as
  a failure (`RPC <code>`, code only — never the upstream message) instead of a success
  toast; the secured-deployment rejection keeps surfacing the sanitized `HTTP 400`.
- api: the conductor task-creation route clamps a hub status outside 400-599 to 502, so an
  out-of-range status can no longer turn a hub refusal into a `RangeError`.
- dashboard: the History tab's `onActionDone` keeps the drawer mounted (and refreshes the
  range) instead of closing it, so the repeat/cancel confirmation is actually visible.
- a2a: documented the recall owner-id limitation — `task.owner` is a SHA-256 key prefix
  while memory rows are keyed by the DB api-key id, and no hash-to-id lookup exists today,
  so recall only resolves under the keyless posture.

* refactor(dashboard): split drawer repeat helpers and test file under the size/complexity gates

---------

Co-authored-by: Markus Hartung <diegosouzapw@users.noreply.github.com>

docs/openapi.yaml

@@ -8953,6 +8953,14 @@ paths:
       responses:
         "200":
           description: OK
+  /api/conductor/tasks:
+    post:
+      tags:
+        - Conductor
+      summary: "POST conductor › tasks"
+      responses:
+        "201":
+          description: Created
   /api/conductor/tasks/{id}:
     get:
       tags:

docs/reference/ENVIRONMENT.md

@@ -502,6 +502,7 @@ detection above).
 | `OMNIROUTE_API_KEY_ID`                          | _(unset)_                                           | `open-sse/mcp-server/audit.ts`                              | Key ID for MCP audit log attribution.                                                                                                                                   |
 | `ROUTER_API_KEY`                                | _(unset)_                                           | Legacy                                                      | Legacy alias for `OMNIROUTE_API_KEY`.                                                                                                                                   |
 | `OMNIROUTE_A2A_HISTORY_RETENTION_DAYS`          | `30`                                                 | `src/lib/a2a/taskManager.ts`                                 | Days of A2A task history kept in the local database before the daily purge deletes a row. Unset, non-numeric, or `<= 0` falls back to `30`.                             |
+| `OMNIROUTE_A2A_MEMORY_HITS`                     | `1`                                                  | `src/lib/a2a/taskExecution.ts`                                | Kill-switch for the A2A memory-hits observability feature. Set to `0` to skip the memory recall lookup for a task entirely; any other value (including unset) keeps it enabled. |
 | `OMNIROUTE_ISSUE_AGENT_ENABLED`                 | `false`                                             | `src/app/api/issue-agent/runs/route.ts`                     | Enables the offline/local Issue Agent recorded-triage endpoint. Leave disabled unless explicitly running local recorded-triage workflows.                              |
 | `OMNIROUTE_ISSUE_AGENT_TIMEOUT_MS`              | _(unset)_                                            | `src/lib/issueAgent/execution.ts`                            | Timeout (ms) for a single Issue Agent recorded-triage run. Clamped to an internal maximum; falls back to the built-in default when unset or invalid.                    |
 | `OMNIROUTE_CONTEXT`                             | _(active context)_                                  | `bin/cli/program.mjs`, `bin/cli/api.mjs`                    | CLI remote-mode context/profile for `omniroute` commands; overrides the active context in the local contexts store. Equivalent to `--context <name>`.                   |