feat: add production assurance dashboard flow

packages/casan-control-panel/README.md

@@ -1,7 +1,8 @@
 # CASAN Ops Console (Plan-13 Track 1/2/3/4 + Command Center) — Control Panel
 
 Real **NestJS API + React UI** that surfaces CASAN harness telemetry and governed settings
-management. This is the Level-3 `casan-platform` **Control Panel** component.
+management. This is the `casan-platform` **Control Plane** preview. “Platform”
+is a product edition, not a CASAN Maturity L3 claim.
 Monitoring remains read-only ("Đọc ≠ Ghi"). Settings writes go through RBAC and the
 harness-owned governance CLI; the UI never writes harness files directly or bypasses a gate.
 
@@ -11,6 +12,18 @@ frontend/  React + Vite + Tailwind + TanStack Query Ops Console + Settings/Appro
 ```
 
 ## Run (local)
+
+Preferred golden path from an adopted project:
+
+```bash
+casan dashboard start             # starts API + UI, enrolls the local deep link
+casan dashboard status
+casan view                        # opens the most recent prompt trace
+casan dashboard stop
+```
+
+Manual developer mode:
+
 ```bash
 npm install                      # from repo root (picks up the workspaces)
 npm run console:api              # NestJS API  → http://127.0.0.1:3010/api/v1
@@ -33,6 +46,24 @@ Harness reports:
   no maturity score is hard-coded.
 - `/reports/h6` — UI report view with project, time-range and run filters plus source-level
   freshness and data-quality warnings.
+- `GET /api/v1/reports/run/:traceId` and `/export?format=html|json` — complete
+  per-prompt H1–H7 assurance receipt with truthful H6 availability.
+- `POST /api/v1/ingest/turn` — optional central ingestion. Disabled unless
+  `CASAN_CP_INGEST_TOKEN` is set; requests require a five-minute timestamp and
+  HMAC-SHA256 signature. Raw prompt/tool content keys are rejected.
+
+Core always writes a sanitized pending envelope locally first. Central delivery
+is asynchronous and never delays or changes a prompt verdict:
+
+```bash
+export CASAN_CONTROL_PLANE_TOKEN='use-a-secret-manager-in-production'
+casan init \
+  --dashboard-url https://casan.example \
+  --ingest-url https://casan.example/api/v1/ingest/turn
+```
+
+The server receives the same secret as `CASAN_CP_INGEST_TOKEN`. The secret name,
+not the secret value, is stored in project configuration.
 
 Metrics export: `GET /api/v1/metrics` provides Prometheus text exposition for
 aggregate freshness, run/failure/cost/token and H4/H5/action/incident counters.