feat(analytics): expose private operator recommendation quality report

[bittoby]

Summary

Closes #305

• Adds a private operator-only recommendation quality report to the operator dashboard.
• Shows aggregate quality, role-aware surfaces, trends, and failure categories without exposing raw private scoring context.
• Keeps public exports unavailable by default.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

UI Evidence

The screenshots below are GitHub-hosted evidence captured from the operator dashboard route with deterministic API fixtures matching the implemented report states.

State	Evidence
Populated report: role surfaces, trend bars, and failure categories are visible.
Sparse report: sparse badge and warning are shown for low sample size.
Empty report: empty badge, zero totals, no role-specific outcomes, and empty warnings are shown.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. All listed checks were run locally.
• npm run test:coverage passed with branch coverage at 97.06%.
• Screenshot states were reconfirmed against the implementation: populated, sparse, and empty recommendation-quality report states.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Adds an operator-only recommendation quality report inside /v1/app/operator-dashboard.
• Separates miner, maintainer, repo-owner, and operator recommendation surfaces where data exists.
• Reports populated, empty, sparse, trend, and failure-category states.
• Public export is unavailable by default for the recommendation quality report.
• No OpenAPI/generated JSON changes were introduced.

[JSONbored]

@bittoby this is close, but some changes should be made:

A few notes:

• The private operator report direction matches #305.
• The API/test surface looks directionally aligned with the role-aware recommendation-quality work.
• The blocker is PR hygiene/evidence, not the general feature direction.

Required changes:

• Retitle the PR to a scoped Conventional Commit title, for example feat(analytics): expose private operator recommendation quality report.
• Replace the local screenshot path in the PR body with actual GitHub-hosted PR-description evidence (review our contribution guidelines).
• Add a clear UI Evidence or Screenshots section with small clickable thumbnails and captions/state labels for the relevant report states.

Validation expected:

• Keep the current green validation.
• Reconfirm the report states covered by the screenshots match the implementation.

[bittoby]

@JSONbored I've updated. pls review again. thx