feat(plan-13): read-only Ops Console (NestJS API + React UI) — Track 1

Real web Control Panel over CASAN harness telemetry (Level-3 casan-platform component).
Read-only ("Đọc ≠ Ghi"): no settings writes, no gate bypass. Management/RBAC/approval are
Track 2/3 (future, Plan-14). Additive — harness gate untouched (64/0/3).

packages/casan-control-panel/
- backend/ (NestJS, ESM, /api/v1 + ok() envelope): TelemetryReader (jsonl/json, missing→[],
  never fabricates) + TelemetryService (aggregations mirroring generate-agentops-dashboard.py)
  + endpoints overview/runs(+:traceId)/governance/security/incidents/tools/traceability/
  drift/cost, and /healthz (stale-aware 200/503, fail-loud like dashboard-server.py). App
  root + telemetry paths resolve via casan-paths-style marker walk-up (.specify OR
  packages/casan-harness) + honor CASAN_DASHBOARD_* env. Binds 127.0.0.1; refuses
  non-loopback under CASAN_PROFILE=prod. @Inject token so DI works under tsc AND tsx.
  Tests (node native runner) 7/0: reader parse/missing, app-root, overview shape on real
  repo state, freshness/stale fail-loud.
- frontend/ (React+Vite+Tailwind+TanStack, port 5174, proxies to :3010): AppLayout +
  Sidebar + Header (LIVE/STALE badge from /healthz) + pages Overview/Runs/Governance/
  Security/Incidents/Traceability. axios client unwraps ok() envelope. build green.

Wiring: root workspaces + `console:*` scripts. packaging/levels.json + casan-platform
README: platform preview now lists the Ops Console as an implemented component.

Verified: backend build + test 7/0; frontend tsc + vite build; API serves REAL data
(runs=6, provider_tokens=5556, action_blocks=7); /healthz 503 stale → 200 after touch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/casan-control-panel/frontend/src/lib/api.ts

@@ -0,0 +1,44 @@
+// Single axios client for the read-only Ops Console API. Mirrors the OKR app's api.ts:
+// relative baseURL, unwrap response.data.data. All GET (read-only).
+import axios from 'axios';
+
+const client = axios.create({
+  baseURL: import.meta.env.VITE_API_BASE_URL ?? '/api/v1',
+});
+
+async function get<T>(path: string): Promise<T> {
+  const res = await client.get(`/${path}`);
+  return res.data.data as T;
+}
+
+export interface Freshness { stale: boolean; age_s: number | null; stale_after_s: number }
+
+export interface Overview extends Freshness {
+  totals: {
+    runs: number; total_cost: number; avg_latency_ms: number; failures: number;
+    hallucination_signals: number; provider_tokens: number; provider_cost: number;
+    fallback_routes: number; tool_denies: number; action_blocks: number;
+  };
+  harness_signals: Record<string, Record<string, number | string>>;
+  audit_chain: { records: number; head: string | null; last_decision: string | null };
+}
+
+export const api = {
+  overview: () => get<Overview>('overview'),
+  runs: (limit = 50) => get<Freshness & { count: number; runs: any[] }>(`runs?limit=${limit}`),
+  governance: () => get<Freshness & { records: number; by_decision: Record<string, number>; head: string | null; recent: any[] }>('governance'),
+  security: () => get<Freshness & { verdicts: number; by_status: Record<string, number>; benign_fp: any; recent: any[] }>('security'),
+  incidents: () => get<Freshness & { total: number; kill_switch_scopes: string[]; incidents: any[] }>('incidents'),
+  traceability: () => get<Freshness & { matrix: any }>('traceability'),
+  cost: () => get<Freshness & { provider_tokens: number; provider_cost: number; by_provider: any[]; business_kpi: any }>('cost'),
+};
+
+// Health is raw (not enveloped) + carries HTTP status.
+export async function health(): Promise<{ ok: boolean; status: string; metrics_age_s: number | null; runs: number }> {
+  try {
+    const res = await axios.get('/healthz', { baseURL: '', validateStatus: () => true });
+    return { ok: res.status === 200, ...res.data };
+  } catch {
+    return { ok: false, status: 'unreachable', metrics_age_s: null, runs: 0 };
+  }
+}