…or, CSV import + stubs) (#3054) (#3209)

* feat(api): admin-only user CRUD + bulk CSV import endpoints

Add a thin RBAC user-management surface so the dashboard slice (#3054 / M6)
can list, create, edit, delete and bulk-import operator accounts without
going through the generic config_set path.

- crates/librefang-api/src/routes/users.rs: GET / POST /api/users,
  GET / PUT / DELETE /api/users/{name}, POST /api/users/import. Writes
  rebuild the [[users]] array-of-tables in config.toml via toml_edit so
  unrelated comments and sections stay intact, then trigger a kernel
  reload.
- crates/librefang-kernel/src/auth.rs: AuthManager::replace_users — clears
  + repopulates the channel index in place so identity resolution picks
  up the new set without restart.
- crates/librefang-kernel/src/config_reload.rs + kernel/mod.rs: classify
  users diffs as a hot action (HotAction::ReloadUsers) and wire the
  apply_hot_actions handler.
- Sanitize the wire shape: UserView omits api_key_hash and only exposes
  has_api_key. Bulk import accepts a pre-parsed JSON body (the dashboard
  parses CSV client-side) and supports dry_run for preview.

Tests cover full CRUD, validation errors, duplicate detection, rename,
dry-run vs commit semantics, and round-trip persistence (boots a kernel
on a temp home_dir and walks the routes via tower::ServiceExt::oneshot).

Refs #3054

* feat(dashboard): users page with CRUD + identity-linking wizard

Surfaces the new admin-only /api/users endpoints from the previous commit
through a single Users page at /users. Three jobs:

- list/edit/delete users with search + role filter
- a 4-step identity-linking wizard (User -> Platform -> Identifier ->
  Confirm) that walks an admin through binding a Telegram / Discord /
  Slack / Email / WeChat platform_id to an existing user. Each platform
  tile carries the expected platform_id format so admins don't have to
  spelunk the channel docs.
- a drag-drop CSV bulk-import modal with client-side parsing, dry-run
  preview, and a separate commit step that maps to /api/users/import.
  CSV header is name,role,<platform>… — every non-name/role column is
  treated as a channel binding.

Data layer follows AGENTS.md to the letter:

- src/api.ts: listUsers / getUser / createUser / updateUser / deleteUser /
  importUsers + sanitized UserItem shape (no api_key_hash leak).
- lib/http/client.ts: explicit re-exports.
- lib/queries/keys.ts: userKeys factory (hierarchical, anchored).
- lib/queries/users.ts: useUsers / useUser with a client-side filter so
  pages can subscribe with role + search and still share the cache key
  for the underlying list.
- lib/mutations/users.ts: useCreateUser / useUpdateUser / useDeleteUser /
  useImportUsers — every write invalidates the narrowest matching keys
  (lists + the touched detail). The import hook invalidates userKeys.all
  per the bulk-reset escape hatch in AGENTS.md.

App.tsx grows a Users entry under Core; router.tsx grows the /users route.

Refs #3054

* feat(dashboard): permission simulator using existing 4-role enum

Add /users/simulator — pick a user, see which Action variants their role
allows. Decision is computed locally from the ROLE_ORDER index, mirroring
`librefang_kernel::auth::UserRole as u8` (Viewer < User < Admin < Owner).
The action -> required_role table is duplicated from `auth::Action` so the
matrix stays stable even when the daemon doesn't have a server-side
simulator endpoint yet.

When M3 (#3205) lands the per-user policy editor will refine these
results further; this page already pre-wires `usePermissionPolicy` via
the stub hook so hooking it up is a one-line swap.

Refs #3054

* feat(dashboard): audit viewer + budget charts + permission matrix stubs awaiting M3/M5

Three thin pages whose payload depends on still-open PRs:

- /audit: searchable / filterable audit trail. Real shape is wired via
  `useAuditQuery` in lib/queries/audit.ts hitting GET /api/audit/query.
  Endpoint ships with M5 (#3203). Hook is invoked with enabled: false
  so we don't 404-spam pre-M5 daemons; the page renders a placeholder
  pointing at the dependency.
- /users/{name}/budget: per-user spend charts + alert thresholds.
  `useUserBudget` keyed via userBudgetKeys.detail(name) maps to
  /api/budget/users/{name}, also gated until M5.
- /users/{name}/policy: per-user tool/memory policy matrix editor.
  `usePermissionPolicy` + `useUpdateUserPolicy` hit
  /api/users/{name}/policy, gated until M3 (#3205) ships the endpoint.

Key factories are added to keys.ts (auditKeys.query / queries,
userBudgetKeys, permissionPolicyKeys) and registered in keys.test.ts so
the anchoring + 'all factories exist' invariants stay green. The plumbing
(query hooks, mutation invalidation, page routing, nav entry) lands now
so the only delta when M3/M5 merge is dropping the `enabled: false` guard
and rendering the actual table/chart.

Refs #3054

* fix(rbac-m6): gate /api/users to Owner, validate hash, fail loud on corrupt config

Address PR #3209 review:

1. BLOCKING — Admin per-user API key could POST /api/users to create a new
   `role: "owner"` user with a chosen `api_key_hash` and self-promote. The
   handlers had no role check and the comment said the gate would arrive
   "with M3" — M3 (#3205) did not in fact add it. Extend the existing
   `is_owner_only_write` allowlist with a `/api/users*` prefix so every
   mutating call under that surface requires Owner, mirroring
   `Action::ManageUsers` in the kernel. GET stays Admin-or-above so the
   permission simulator's user list keeps working.

2. HIGH — `persist_users` had `unwrap_or_default()` on both
   `read_to_string` and `toml::parse`, so a transient read failure or a
   hand-edited-into-corruption `config.toml` would silently get replaced
   by a stub document containing only `[[users]]` — wiping every other
   section. Both branches now return `PersistError::Internal`; corrupt
   files stay untouched on disk so `backups/config.toml.prev` plus the
   bad file are sufficient for human recovery.

3. MEDIUM — `api_key_hash` was accepted as any string. New
   `validate_api_key_hash` runs `argon2::password_hash::PasswordHash::new`
   to reject anything that isn't a real Argon2id PHC string, applied in
   create / update / bulk import. Empty / whitespace still maps to
   `None` (clear the hash), unchanged.

Tests:
- middleware: `test_user_role_admin_cannot_mutate_users_endpoints` /
  `test_user_role_viewer_can_still_list_users_for_simulator`
- users_test: `users_create_rejects_invalid_api_key_hash` /
  `users_create_refuses_to_overwrite_corrupt_config_toml`
- middleware suite 34/34, users integration 10/10, clippy clean.

* fix(rbac-m6): persist RBAC M3 policy fields + simplify update_user

Re-review of #3209 found the preserve-and-merge logic in `update_user`
and `import_users` only protected the in-memory `Vec<UserConfig>` —
the on-disk write path in `persist_users` hand-emitted just the four M6
fields (name / role / channel_bindings / api_key_hash) and silently
dropped the M3 ones (tool_policy / tool_categories / memory_access /
channel_tool_rules). After every successful PUT, `reload_config()` read
the truncated file back and the per-user policy collapsed to None.

Two changes:

1. `persist_users` now serializes each user via `toml_edit::ser::to_document`
   so the full serde shape (incl. `#[serde(skip_serializing_if)]`-gated
   M3 fields) round-trips through `config.toml`. We use `toml_edit::ser`
   rather than `toml::ser` because `UserConfig` interleaves scalar fields
   (`api_key_hash`) after a nested table (`channel_bindings`), which the
   strict serializer rejects with `ValueAfterTable`. Enabled the `serde`
   feature on `toml_edit` to expose `to_document`.

2. Generalized `persist_users` to `FnOnce(&mut Vec<UserConfig>) -> Result<R>`
   and let the closure thread an arbitrary `R` back to the caller. The
   `Arc<Mutex<Option<UserConfig>>>` capture pattern in `update_user` is
   gone — closure now returns `Ok(users[idx].clone())` directly. Other
   call sites stay at `R = ()`.

Tests:
- New `users_update_and_import_preserve_rbac_m3_policy_fields` seeds a
  Bob with non-default `tool_policy` + `memory_access`, runs PUT (rename
  + role bump) and bulk-import update, asserts the policy fields survive
  by reading back through `state.kernel.config_ref()` (i.e. after the
  disk round-trip). This test FAILED before the persist_users fix.
- 11/11 users_test pass, clippy clean.

…ed (#3225)

* feat(dashboard): activate AuditPage now that M5 audit endpoints shipped

Same root cause as the recent UserBudgetPage activation: PR #3209 (M6
dashboard) shipped AuditPage as a "Pending M5" stub linking back to PR
#3203, then M5 merged and nobody came back to drop the
`enabled: false` guard or fix the wire-format guesses.

What changed:
- `api.ts` — `AuditQueryFilters` / `AuditQueryEntry` / `AuditQueryResponse`
  retyped to match `routes/audit.rs::audit_query`'s actual response. The
  previous shapes were guesses made before the endpoint shipped:
    - filters: `since/until` -> `from/to`; dropped non-existent
      `offset`/`status`; added missing `agent`/`channel`
    - entry: `agent`/`details`/`status`/`user` -> `agent_id`/`detail`/
      `outcome`/`user_id`; added `seq`/`channel`/`hash`
    - wrapper: `total`/`has_more` -> `count`/`limit`
- `lib/queries/audit.ts` — dropped the M5-pending comment.
- `AuditPage.tsx` — rewritten from stub to real viewer:
    - filter form (user, action, agent, channel, from/to)
    - table of entries with seq/timestamp/action/agent/user/channel/outcome/detail
    - CSV export button — local `buildExportUrl` helper inline in the page
      (the URL is for `<a download>`, not a fetch, so it doesn't belong in
      the http/client data layer)
    - 403 banner when the caller isn't an admin (audit is admin-only via
      `require_admin` in routes/audit.rs:98), so the page can degrade
      gracefully for User/Viewer-role api keys instead of just showing
      a generic error.

Server-side tests already cover this surface in PR #3203; this PR is
frontend-only and connects existing wires.

* fix(dashboard/audit): RFC-3339 normalisation, authenticated CSV, robust 403

Four issues caught in review:

1. <input type="datetime-local"> emits 'YYYY-MM-DDTHH:MM' with no
   offset, but the server parses from/to via DateTime::parse_from_rfc3339
   which requires one. Picking from/to and applying filters returned
   400 silently. New toRfc3339 helper treats the picker value as
   local time and converts to ISO-8601 'Z'; applied to both the
   query path and the export URL.

2. CSV export was a bare <a download href="/api/audit/export?...">,
   but the dashboard auths via Authorization: Bearer <key> from
   localStorage. Browser navigation drops custom headers, so on any
   auth-enabled deployment (the actual target of admin-only audit)
   the user downloaded the daemon's 401 / login HTML as audit.csv.
   Replaced with fetch + Blob + programmatic-click pattern that
   carries the Bearer header. Surfaces ApiError status/message in
   an inline export-error banner on failure.

3. isForbidden detection was /403|admin/i.test(error.message), which
   fragility-couples the UI banner to the exact wording of the
   server's 403 body. Changed to error instanceof ApiError &&
   error.status === 403.

4. Pre-existing prop typo: <Button icon=...> — Button accepts
   leftIcon/rightIcon, not icon. The Search glyph next to 'Apply
   filters' would never render. Fixed to leftIcon.

dashboard typecheck passes (the 3 remaining errors in
sessions-stream.test.tsx are pre-existing on main, see
181430b).

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…3224)

* feat(api): per-user budget write/clear endpoints + dashboard editor

Closes the M5 follow-up gap: `UserConfig.budget` was set-via-config.toml
only, but the M6 dashboard already shipped a `UserBudgetPage` stub that
linked back to PR #3203 saying "wire up after M5 lands". M5 has landed
(per-user enforcement is real), so this connects the management plane.

Surface
- `PUT /api/budget/users/{user_id}` — admin-only upsert. Body mirrors
  `UserBudgetConfig` (max_hourly_usd / max_daily_usd / max_monthly_usd /
  alert_threshold). Validates negatives / NaN / infinite + threshold
  range before touching disk so a bad payload returns 400 cleanly. On
  success, `users::persist_users` writes the toml and reloads the kernel
  so the new cap takes effect on the next LLM call.
- `DELETE /api/budget/users/{user_id}` — admin-only clear. Sets
  `UserConfig.budget = None` and persists. Idempotent (cleared user gets
  200, no error).
- Both record a `RoleChange` audit event with the caller's user_id, same
  shape as `update_user`.

Both reuse `require_admin_for_user_budget` (the existing gate on the GET
sibling) — Owner-level isn't required because budget management mirrors
`update_agent_budget` semantically. `users::persist_users` and
`PersistError` lifted from module-private to `pub(crate)` so the budget
handler can share the same toml-write path that user CRUD uses.

Dashboard
- `api.ts`: `UserBudgetResponse` retyped to match the actual server shape
  (`{user_id, name, role, hourly{spend,limit,pct}, daily{...},
  monthly{...}, alert_threshold, alert_breach, enforced}`). The previous
  shape was an M5-stub guess that never matched the wire format.
- New `useUpdateUserBudget` / `useDeleteUserBudget` mutations; both
  invalidate `userBudgetKeys.detail(name)` plus `userKeys.detail(name)`
  + `userKeys.lists()` since `UserConfig.budget` is part of `UserItem`.
- `UserBudgetPage` rewritten from stub to live editor: spend bars per
  window, limit / threshold form, validation (negative / out-of-range)
  matched to server; "Clear cap" button that calls DELETE.

Tests
- `test_user_budget_put_get_delete_round_trip`: PUT 1.5/12/100 USD
  caps, assert GET reflects them, DELETE, assert GET is back to 0.
- `test_user_budget_put_rejects_invalid_payload`: -1.0 hourly,
  threshold=1.5, threshold=-0.1 — all 400.
- `test_user_budget_put_rejects_viewer_with_403`: Bob (viewer) PUT
  against Alice → 403, gate from in-handler `require_admin_for_user_budget`.
- `test_user_budget_put_unknown_user_returns_404`: PUT against
  NonExistent surfaces 404 instead of silent insert.

* fix(api/budget): require full payload, fix audit action, run fmt

Addresses review on #3224:

1. cargo fmt — collapsed two split format!() literals on budget.rs that
   tripped the Quality CI check.
2. PUT /api/budget/users/{id} now rejects partial bodies with 400
   instead of silently zeroing missing windows. UserBudgetConfig has
   #[serde(default)], so a previous `{"max_hourly_usd": 5}` would have
   reset daily/monthly/alert to defaults — clearing an existing cap
   without warning. Also rejects wrong-typed values (`"1.0"` as a
   string) with 400 instead of coercing to 0.0.
3. Audit detail now records the target user_id alongside the new
   values, so "who changed Bob's budget" is one log line instead of a
   timestamp+number-fishing exercise.
4. AuditAction switched from RoleChange → ConfigChange. RoleChange is
   reserved for admin/editor/viewer flips; budget edits are config
   changes. Keeps the audit filter clean.

New regression test test_user_budget_put_rejects_partial_payload pins
all four shapes that must 400: missing key, multiple-missing, empty
object, and string-typed number. Existing 404 / 403 / round-trip /
invalid-value tests updated to send full-shape bodies.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

#3240)

PR #3203 shipped /api/audit/export but both the JSON and CSV emitters
dropped `prev_hash`. Without it, a downstream verifier cannot replay
the SHA-256 hash chain off the dump alone — defeating the whole point
of the chain.

Append `prev_hash` as the last field on the JSON object and as the
last column on the CSV row, after the existing `hash`. Column order
of all pre-existing fields is preserved so any downstream parsers
keyed off the documented schema only need to add the new tail column.

Tests:
- audit::tests::test_stream_json_includes_prev_hash — parses the
  streamed body and asserts prev_hash round-trips for one entry.
- audit::tests::test_stream_csv_includes_prev_hash_column — pins the
  new header row and asserts the per-entry row ends with hash,prev_hash.
- Updated test_audit_export_csv_emits_documented_headers to expect
  the new header schema.

Out of scope: the same review flagged that audit_export buffers the
filtered Vec in memory before streaming. That's a separate
optimization (true row-by-row streaming from SQLite) and is left for
a follow-up PR.