Harden feed pipeline + admin security, add operator tooling, and ship new UI control surface

[Copilot]

Summary

• This PR implements the improvement plan end-to-end: stronger feed/data integrity, richer build observability, reliability-aware scheduling, tighter admin security, and expanded UI/operator workflows.

• It also adds deterministic E2E coverage and contributor guardrails so regressions surface earlier and source-catalog quality scales better.

• Feed integrity + quality gates

  • Added schema-aware live-feed validation and stricter per-alert structural checks.
  • Tightened source-catalog validation (ID format, URL hygiene, malformed endpoint rejection).
  • Kept validator backward-compatible for existing live-alerts.json payloads without schema version.

• Observability + operations

  • Build now emits structured diagnostics + trend artifacts:
    • data/build-observability-summary.json
    • data/build-observability-trend.json
  • Wired artifacts into CI/hygiene workflows.
  • Added runbook: docs/runbooks/operations.md (stale feed, outage, quarantine restore paths).

• Reliability scoring + scheduling

  • Added source reliability decay/rehabilitation in source health state.
  • Scheduling priority now accounts for source health reliability signals and recovery streaks.

• Deduplication/clustering

  • Extended dedupe with semantic near-duplicate matching (location/event/time + token similarity), reducing repeated incident variants.

• UI control surface + performance

  • Added lane filter, severity threshold, and muted-source controls with persisted state.
  • Added map-item capping/prioritization to reduce marker/render pressure on low-end devices.

• Admin/security hardening

  • Added trusted-origin enforcement for mutating admin endpoints.
  • Added admin audit logging across auth/session/quarantine/restore/logout flows.
  • Improved CORS preflight caching behavior.

• Contributor workflow + coverage

  • Added PR template with explicit source-curation checklist.
  • Added source-catalog lint-hints script and CI integration.
  • Added Playwright E2E tests for dashboard/map/watchlists/quarantine restore flows.

if (parsed.schemaVersion === '2026-04-live-feed-v1') {
  if (!parsed.runMetrics?.coverage) fail('runMetrics.coverage block is required for schemaVersion 2026-04-live-feed-v1');
}

Source curation checklist

• I ran npm run compile:sources
• I ran npm run check:sources:freshness
• I ran npm run check:sources:hints
• I documented replacement/removal rationale for risky or dead endpoints

Validation

• I ran npm run validate:feed-data
• I ran npm run validate:live-feed-output (if feed output changed)
• I ran npm test

Operational impact

• No user-facing behavior change
• User-facing behavior changed (describe below)

Notes

• User-visible additions: lane/severity filtering and source muting controls in the main feed UI.
• New observability artifacts are generated by feed builds and included in CI/hygiene artifact flows.
• E2E tests are included and are environment-gated when Playwright browser binaries are unavailable.