Admin: Add the operational and moderation dashboard aggregate API

[gekichumai-admin]

Phase / step: Phase 4 — Dashboard and operational readiness / Step 5
Parent: #301
Depends on: #319, #330

Context and goal

The admin landing page needs one bounded read model that summarizes system state and moderation workload without becoming a pipeline control plane. It must distinguish healthy, stale, unknown, and unavailable data, tolerate partial dependency failures, and supply direct filter/deep-link context for investigation screens.

Scope and implementation notes

• Add an administrator-only /api/admin dashboard aggregate procedure. Return independently statused sections for backend health and deployed version, active dataset publication/freshness, recent source failures, unresolved provenance gaps, recent chart changes, recent comments, active bans, and the administrator roster.
• Include one server observation timestamp and source-specific timestamps/time windows for every metric. Return absolute UTC timestamps, ages/durations, and explicit healthy, warning, stale, unknown, or unavailable states according to source-controlled thresholds; never convert missing data to a healthy zero.
• Limit service/version output to safe build/release metadata and dependency readiness. Do not expose hostnames, internal network topology, environment variables, credentials, database connection details, object-store identifiers, or deployment-provider internals.
• Resolve dataset freshness from the active promoted publication receipt and source freshness ledger. Include publication revision/fingerprint, published-at time, age, and source counts by fresh/stale/unknown/failed state without presenting an unpromoted stage as current.
• Summarize recent source failures using bounded safe error categories and timestamps. Redact response bodies, headers, signed URLs, credentials, and raw source content. Include filter parameters or stable source identifiers needed to open a read-only investigation view, not run/retry controls.
• Return provenance-gap totals by unknown and historical_incomplete, affected chart/field counts, and a small bounded sample with stable chart/publication/field deep links. A producer contract failure or missing resolution row must be reported separately from an ordinary accounted gap.
• Return bounded recent chart-change and recent-comment previews with documented windows plus links/filter state for their complete screens. Comment previews must follow approved admin PII limits and deletion/original-body authorization rules.
• Return active-ban counts split by temporary/permanent and effective target role, nearest expiries where useful, and a bounded safe preview. Return the administrator roster summary from the effective DB-admin/allowlisted-superadmin read model with approved identity/role/status fields, without exposing the allowlist source, login activity, or configuration.
• Execute independent reads concurrently with per-section timeouts where safe. A failure in source health must not erase moderation results; return cached/previous data only when its age and stale status are explicit. The top-level request should fail only when authorization or the aggregate contract itself cannot be established.
• Design query budgets and short cache/freshness hints for React Query focus/reconnect/manual refresh behavior. Do not add recurring server polling, SSE, WebSockets, background pipeline execution, or a mutation endpoint.
• Add integration tests for healthy, zero, stale, unknown, partial-failure, and total-dependency-failure scenarios; safe metadata/redaction; permission enforcement; bounded result sizes; query counts; observation timestamps; and links to supported chart/comment/user/admin filters.

Acceptance criteria

• The aggregate contains independently statused sections for health/version, dataset freshness, source failures, provenance gaps, chart changes, comments, active bans, and administrator roster.
• Every metric names its observation time/window and distinguishes healthy, warning, stale, unknown, unavailable, and true zero where applicable.
• Only promoted publication data is identified as active, with safe revision/fingerprint and freshness information.
• Provenance gaps distinguish unknown, historical_incomplete, and producer-contract failures and provide stable investigation links.
• Source failures and service metadata are redacted of secrets, internal topology, raw content, and unsafe URLs.
• Recent previews and roster/ban summaries obey approved PII and role rules and are strictly bounded.
• One section's timeout or failure does not hide successful sections; stale fallback data is labeled with its real age.
• Query duration/count and response-size budgets are tested at representative volume.
• The endpoint is read-only, administrator-protected, and absent from public OpenAPI.
• No pipeline mutation, global audit-log feed, polling stream, or analytics integration is introduced.

Out of scope

• Starting, retrying, publishing, promoting, or rolling back the data pipeline.
• A global audit-log dashboard.
• PostHog or product analytics.
• Real-time streaming, blanket polling, or alert delivery.
• Infrastructure topology or secret-bearing operational diagnostics.