Act on the wj architectural review: races, limits, pool and contract gaps

Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from
wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3
(the warranty sync holding a pooled connection) are being handled separately
and are untouched here.

- A collector check-in that raced another for the same PC lost everything:
  the unique index on the application fingerprint raised, nothing caught it,
  and the whole check-in rolled back, discarding state, events and hardware,
  answering the agent with form copy meant for a person. The insert now runs
  in a savepoint, reconciles what the other transaction already wrote, one row
  per savepoint so a second collision skips a row rather than the batch, and
  the check-in commits with a warning. This is the shape the delete side of
  the same function already had.
- Enrollment is deliberately unauthenticated, so it now carries a per-address
  rate limit and a cap on pending requests, and the cap is a setting an admin
  can see and change. A flood can no longer bury the approval queue or grow
  the table without bound.
- The fleet alert poll no longer formats debug strings on every request.
- BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin
  stops reaching into a core table with raw SQL.
- A test walks every asset type descriptor and proves the endpoint it names
  really refuses a caller without the declared permission.
- The plugin settings routes now need a permission; they were telling anyone
  which modules a site runs and where its components live.
- The connection pool is sized explicitly with a short timeout, and the
  arithmetic against the server's connection ceiling is written next to the
  worker count instead of being left to defaults nobody chose.
- Fleet alerts carry both the correct lowercase keys and the old camelCase
  pair. Trays older than 1.7.0 match keys case-sensitively and would have gone
  quiet on every PC not yet upgraded; the old pair goes when they are.
- The dev server proxy points at localhost again, with environment variables
  for the remote-box workflow, and one developer's address is out of the
  server certificate page.

frontend/src/views/settings/ModelCatalogHub.vue

@@ -48,7 +48,9 @@
 <script setup>
 import { ref, onMounted } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
-import axios from 'axios'
+// The shared api instance, not raw axios: this route is gated on settings.view
+// now, and only this client attaches the bearer token and the mount-path base.
+import api from '@/api'
 
 const route = useRoute()
 const router = useRouter()
@@ -57,7 +59,7 @@ const pluginTabs = ref([])
 onMounted(async () => {
   // Fetch plugin-contributed settings routes
   try {
-    const response = await axios.get('/api/plugins/settings-routes')
+    const response = await api.get('/plugins/settings-routes')
     if (response.data && response.data.data) {
       // Filter for model-catalog hub routes
       pluginTabs.value = response.data.data.routes.filter(r => r.hub === 'model-catalog')

frontend/vite.config.js

@@ -2,6 +2,21 @@ import { defineConfig } from 'vite'
 import vue from '@vitejs/plugin-vue'
 import path from 'path'
 
+// Dev proxy target for /api and /static. Default is the local Flask dev server.
+// To develop against a backend on another box, set it per shell, never here:
+//   VITE_DEV_API_TARGET=https://10.0.0.5:5001 npm run dev
+// Certificates on such a box are usually self-signed, so verification is off by
+// default; VITE_DEV_SECURE=true turns it back on for an https target.
+const devApiTarget = process.env.VITE_DEV_API_TARGET || 'http://localhost:5001'
+const devApiSecure = devApiTarget.startsWith('https:')
+  && process.env.VITE_DEV_SECURE === 'true'
+
+const devProxy = {
+  target: devApiTarget,
+  changeOrigin: true,
+  secure: devApiSecure
+}
+
 export default defineConfig({
   // Mount path of the built app. Default '/' (own IIS site / dev). Set
   // VITE_BASE_PATH='/ops/' (trailing slash) to build for a subpath mount under
@@ -14,19 +29,12 @@ export default defineConfig({
     }
   },
   server: {
+    // all interfaces, so a VM or phone on the LAN can load the dev server
     host: true,
     port: 5173,
     proxy: {
-      '/api': {
-        target: 'https://192.168.100.1:5001',
-        changeOrigin: true,
-        secure: false
-      },
-      '/static': {
-        target: 'https://192.168.100.1:5001',
-        changeOrigin: true,
-        secure: false
-      }
+      '/api': { ...devProxy },
+      '/static': { ...devProxy }
     }
   }
 })