Add live background job count deltas

[kaspernj]

Summary

• add durable database-scoped background-job count revisions and canonical snapshots
• emit exact signed count deltas after committed job mutations, including aggregate prune events
• expose authorized /api/counts snapshot and /ws/counts live channel endpoints
• preserve legacy /api/stats.total semantics while adding counts.all for active tabs
• document client recovery behavior: apply consecutive revisions, ignore duplicates, refetch on gaps/reconnect

Correctness

• revisions and deltas commit in the same database transaction as each logical mutation
• rolled-back mutations publish nothing
• concurrent prune workers account from actual affected rows, preventing duplicate negative deltas
• WebSocket subscriptions are mount-token authorized and database-scoped

Validation

• 49 focused store/count/channel tests passed
• 10 focused background-jobs API tests passed
• npm run lint passed with zero warnings (includes typecheck and fallow)
• npm run build passed
• git diff --check origin/master...HEAD passed
• complete Threadwire review plus focused re-review passed with no remaining actionable findings

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8b8afee64f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require origin checks before authorizing count subscriptions

When a jobs mount relies on the documented loopback fallback (no accessTokens/authorize) or on cookie-backed ability auth, this WebSocket subscription reuses the HTTP authorization path without any Origin check; the WebSocket upgrade path accepts the connection before routing frames (checked src/http-server/client/index.js 245-267), and browsers do not apply CORS to WebSockets. A third-party page can therefore open a socket to a local/same-site app, send mountAt, and receive live job-count deltas even though GET /api/stats would be protected by CORS. Gate this channel on same/allowed origins or require the bearer-token path for WebSocket subscriptions.

Useful? React with 👍 / 👎.