Add bounded read-only lifecycle HTTP API

[Punisheroot]

Summary

Add an authenticated, deterministic, read-only HTTP surface for inspecting the authoritative development lifecycle store.

The new list, detail, and event routes expose bounded safe projections while preserving the existing lifecycle state machine as the single source of truth. Closes #20.

Implementation

• Add GET /api/v1/lifecycles with canonical change-ID ordering, a default limit of 50, and a hard maximum of 100.
• Add GET /api/v1/lifecycles/{change_id} and GET /api/v1/lifecycles/{change_id}/events using the existing session, Host, and Origin security boundary.
• Replay each selected lifecycle against its bounded append-only journal before returning list, detail, or event data, rejecting corrupt or unknown stored values.
• Project explicit versioned DTOs for lifecycle identity, phase/status, state digest, frozen profile and test-plan identities, budgets and usage, artifact references, terminal reasons, and redacted cleanup/recovery state.
• Omit internal domain/event objects, request text, test commands, repository roots, apply journals, transcripts, credentials, and artifact bytes.
• Read only the latest apply record with deterministic ORDER BY ... DESC LIMIT 1; no lifecycle route mutates SQLite state.
• Add adversarial runtime and route tests for authentication, empty/missing/malformed inputs, ordering, accepted and rejected limits, event sequence, redaction, replay corruption, unknown values, latest recovery selection, and zero lifecycle writes.

Existing lifecycle transitions, role-profile routes, and frontend behavior are unchanged. rusqlite is added only as a needle-app dev-dependency for database-level route fixtures and write-detection assertions.

Validation

npm run build
PASS — TypeScript and Vite production build completed; 2,015 modules transformed.

cargo test --locked -p needle-runtime lifecycle_summary_query_is_bounded_ordered_read_only_and_replay_validated
PASS — 1 passed.

cargo test --locked -p needle-app lifecycle_routes_are_authenticated_bounded_ordered_safe_and_read_only
PASS — 1 passed.

cargo test --locked --workspace
PASS — 444 passed, 1 ignored across 24 suites.

cargo clippy --locked --workspace --all-targets -- -D warnings
PASS — no issues found.

cargo fmt --all -- --check
PASS.

cargo build --locked --workspace
PASS.

git diff --check
PASS.

No provider-backed run or browser run was performed; neither is required by this issue. Cross-platform execution remains delegated to pull-request CI.

Risks/limitations

• The list is intentionally capped at 100 records and does not add cursor pagination; the domain journal remains capped at its existing 16-event maximum.
• A list request replays every selected lifecycle to fail closed on corruption. Work is therefore bounded by at most 100 lifecycles times the existing event bound rather than by unbounded history.
• The API is read-only and does not add lifecycle start, transition, cancellation, approval, apply, retry, polling, SSE, or UI behavior.
• Recovery reports only the latest bounded apply status and safe digests/identities; repository roots and recovery journals remain private.

Documentation/evidence

• Updated PROJECT_STATUS.md to record the bounded authenticated lifecycle HTTP API and its offline evidence.
• Updated docs/ARCHITECTURE.md with the replay-before-projection and safe-DTO boundary.
• Updated docs/RUNTIME_AND_WEB_CONTROL_PLANE.md with routes, schemas, limits, redaction, and read-only behavior.
• Updated docs/VERIFIED_CHANGES.md to distinguish the implemented HTTP surface from the still-unwired lifecycle UI and concrete Codex adapters.

AI assistance and human verification

AI assistance: investigation, code, tests, documentation — audited the lifecycle store and server security boundaries, implemented replay-backed bounded queries and safe DTO routes, and added adversarial corruption, redaction, ordering, and zero-write coverage.
Human verification: Reviewed the complete diff file by file; checked route authentication and error mapping against the existing server middleware; traced list, detail, event, replay, and latest-apply queries to SQLite; verified that sensitive internal fields cannot enter the explicit DTOs; confirmed the final worktree contains only issue #20 changes; and personally ran the focused tests, full workspace suite, Clippy, formatting, frontend build, Rust build, and diff checks reported above.

Ownership checklist

• I read and understand the complete diff and can explain every material change.
• I personally verified the reported tests and technical or performance claims.
• I finalized and personally published the commits and this pull request.
• I checked for unrelated edits, credentials, generated files, and live artifacts.
• Public documentation and PROJECT_STATUS.md are updated when applicable.