Browse passive auth reports and raw evidence

[justsml]

Summary

• make artifact rows open a reload-stable, read-only report view
• return a separately validated, bounded structured passive-auth report so reports larger than the 32 KiB raw preview retain every target, route, blocker, unknown, and next step
• enforce the shared schema and 512 KiB serialized-size limit before app-produced passive-auth reports reach artifact persistence
• fail calmly when structured report JSON is invalid, unsupported, unavailable, or over limit
• preserve the explicit 32 KiB, secret-redacted raw-evidence reveal without client parsing of truncated JSON
• range external object reads and stop streaming near the requested byte cap instead of loading full objects
• return 404 for cross-project artifact reads and calm states for binary or unavailable previews
• contain keyboard focus inside the report dialog and restore the exact artifact trigger after explicit close or browser Back

Safety

This browser remains passive and read-only. It adds no probe, network, shell, download, approval, or mutation action.

Tests

• pnpm vitest run --config vitest.integration.config.ts tests/integration/artifact-report-api.test.ts tests/integration/artifact-service.test.ts tests/integration/discovery-artifact-normalizer.test.ts (20 passed)
• pnpm vitest run --config vitest.integration.config.ts tests/integration/upload-artifact-usage-e2e.test.ts (10 passed)
• ARTIFACT_FOCUS_BASE_URL=http://127.0.0.1:33210 pnpm exec playwright test tests/playwright/artifact-report-focus.spec.ts --project=chromium (1 passed)
• pnpm typecheck
• pnpm build (passes with existing broad Turbopack file-tracing warnings)

Review gate

DRAFT: do not merge until a human reviews the report information hierarchy and the raw-evidence wording required by issue #168. Keep #168 open until that review is complete.

Depends on #176. Tracks #168.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Consolidate duplicate report object reads, keep all raw/structured reads bounded, and complete the issue's explicit human information-hierarchy/raw-evidence review. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.