feat(infra): commit live infra-audit/cluster work to reconcile git with prod

This work (network_hosts inventory + infra_audit MCP tool, /api/cluster +
Sacred Valley cluster card, topbar cluster-health pill + SW self-heal) was
built in an earlier session and DEPLOYED to CT 311 as alpha.24–26, but was
never committed to git — prod was running code absent from the repo. Commits
it as-is (already prod-validated) so git matches the live state, and restores
its alpha.24/25/26 CHANGELOG entries. Files are disjoint from the fold-in
work; both now ship together under alpha.27.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/api/routes/infra.js

@@ -0,0 +1,26 @@
+import { Router } from 'express';
+import { asyncWrap } from '../errors.js';
+import { pool } from '../../db/pool.js';
+import * as monitored from '../../db/repos/monitored_services.js';
+import * as networkHosts from '../../db/repos/network_hosts.js';
+import { runAudit, tcpProbe } from '../../infra/audit.js';
+
+// Read-only infra sanity check: probe every IP:port referenced in the wiki and
+// every enabled service URL, and surface hosts missing a recorded MAC. Available
+// to the owner or any authed agent (no mutations, just TCP connects).
+export const router = Router();
+
+const probe = (host, port) => tcpProbe(host, port, 1500);
+
+router.get('/audit', asyncWrap(async (_req, res) => {
+  const { rows: pages } = await pool.query(
+    `SELECT p.title, p.body_md FROM pages p JOIN spaces s ON s.id = p.space_id WHERE s.slug = 'wiki'`);
+  const services = (await monitored.listEnabled()).filter(s => /^https?:\/\//.test(s.url || ''));
+  const report = await runAudit({ pages, services, probe });
+  const missingMac = (await networkHosts.missingMac()).map(h => h.id);
+  res.json({ ...report, inventory: { missing_mac: missingMac } });
+}));
+
+router.get('/hosts', asyncWrap(async (_req, res) => {
+  res.json({ hosts: await networkHosts.all() });
+}));