feat(infra): commit live infra-audit/cluster work to reconcile git with prod

This work (network_hosts inventory + infra_audit MCP tool, /api/cluster +
Sacred Valley cluster card, topbar cluster-health pill + SW self-heal) was
built in an earlier session and DEPLOYED to CT 311 as alpha.24–26, but was
never committed to git — prod was running code absent from the repo. Commits
it as-is (already prod-validated) so git matches the live state, and restores
its alpha.24/25/26 CHANGELOG entries. Files are disjoint from the fold-in
work; both now ship together under alpha.27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/api/index.js

@@ -32,6 +32,8 @@ import { router as securityRouter } from './routes/security.js';
 import { router as actionsRouter } from './routes/actions.js';
 import { router as littleblueRouter } from './routes/littleblue.js';
 import { router as aiUsageRouter } from './routes/ai_usage.js';
+import { router as infraRouter } from './routes/infra.js';
+import { router as clusterRouter } from './routes/cluster.js';
 
 export function mountApi(app) {
   const api = Router();
@@ -45,6 +47,8 @@ export function mountApi(app) {
   api.use('/spaces/:space_id/companion', companionRouter);
   api.use('/security', securityRouter);
   api.use('/actions', actionsRouter);
+  api.use('/infra', infraRouter);
+  api.use('/cluster', clusterRouter);
   api.use('/little-blue', littleblueRouter);
   api.use('/ai-usage', aiUsageRouter);
   api.use('/projects', projectsRouter);

lib/api/routes/cluster.js

@@ -0,0 +1,17 @@
+import { Router } from 'express';
+import { asyncWrap } from '../errors.js';
+import { clusterHealth } from '../../proxmox/cluster.js';
+
+// Read-only cluster health for the Sacred Valley card. Cached briefly so multiple
+// polling clients coalesce into one PVE call. Owner or any authed agent.
+export const router = Router();
+
+let cache = { at: 0, data: null };
+const TTL = 10_000;
+
+router.get('/', asyncWrap(async (_req, res) => {
+  if (cache.data && Date.now() - cache.at < TTL) return res.json(cache.data);
+  const data = await clusterHealth();
+  cache = { at: Date.now(), data };
+  res.json(data);
+}));

lib/api/routes/infra.js

@@ -0,0 +1,26 @@
+import { Router } from 'express';
+import { asyncWrap } from '../errors.js';
+import { pool } from '../../db/pool.js';
+import * as monitored from '../../db/repos/monitored_services.js';
+import * as networkHosts from '../../db/repos/network_hosts.js';
+import { runAudit, tcpProbe } from '../../infra/audit.js';
+
+// Read-only infra sanity check: probe every IP:port referenced in the wiki and
+// every enabled service URL, and surface hosts missing a recorded MAC. Available
+// to the owner or any authed agent (no mutations, just TCP connects).
+export const router = Router();
+
+const probe = (host, port) => tcpProbe(host, port, 1500);
+
+router.get('/audit', asyncWrap(async (_req, res) => {
+  const { rows: pages } = await pool.query(
+    `SELECT p.title, p.body_md FROM pages p JOIN spaces s ON s.id = p.space_id WHERE s.slug = 'wiki'`);
+  const services = (await monitored.listEnabled()).filter(s => /^https?:\/\//.test(s.url || ''));
+  const report = await runAudit({ pages, services, probe });
+  const missingMac = (await networkHosts.missingMac()).map(h => h.id);
+  res.json({ ...report, inventory: { missing_mac: missingMac } });
+}));
+
+router.get('/hosts', asyncWrap(async (_req, res) => {
+  res.json({ hosts: await networkHosts.all() });
+}));