Add native Agents, operations, setup and network-policy settings

[VibeSWE]

Description

Previously classic-only Agents, Cluster, Errors and setup routes now open native pages. Network access edits the existing outbound alert-target policy, with full-policy saves, server validation, permission handling and unsaved-change protection.

• Agents discovers flattened GenAI telemetry, queries the latest 100 records within a selected range, supports record inspection and trace handoffs.
• Cluster displays nodes and resource metrics independently. Errors lists and paginates OTLP error spans with trace links.
• Onboarding routes datasets to their matching explorer and reuses Add data. /new explains the server workspace and offers connection/setup actions.
• Keystone and LLM settings have explicit capability pages because management APIs are absent. Hosted-workspace provisioning, agent run/cost analytics and grouped error issues remain outside the supported backend scope.
• Routes work at / and /next; shared client/session handling, demo fixtures, accessibility states and regression coverage are included. Network policy is outbound alert-target control, not ingress control, and does not provide cross-node propagation.

Five Sol 6.1 agents and four Claude Opus 5.5 review rounds covered implementation, contracts, code quality and regressions. Final Opus review found no blocking findings; remaining validator edge cases were addressed.

Validation

• Production build, TypeScript, formatting and diff checks pass.
• 2,166 unit tests pass; one pre-existing skip.
• 30 focused browser tests pass together against a fresh production bundle.
• 49 native Storybook checks pass across a serial run and one isolated retry.
• 22 production mount/stale-asset checks pass; 26 classic-link/onboarding checks passed during integration.

The broader suites are not clean on this host. The 493-test development-server run was stopped after Chromium/resource errors: 238 passed, 45 failed, 3 interrupted, 1 skipped and 206 not run. Full Storybook: 162 passed, 59 failed (38 screenshot assertions, 21 runtime/resource failures). A representative grouped-bars mismatch reproduced identically on origin/main; this does not establish that every failure is unrelated. No screenshot baselines were updated. Browser APIs are mocked; these checks do not establish live distributed-cluster or policy-propagation behavior.

Details: frontend/docs/validation-review.md, frontend/docs/prism-parity.md and the shared Mayfly page frontend/prism-retirement/native-missing-screens.

Checklist

• Verified live log ingestion and log query for this change (not rerun; existing ingestion implementation unchanged).
• Added explanations where contract or scope constraints require them.
• Documented new behavior, limitations and validation evidence.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[comment-clanker]

Independent reviews by GPT-6.1-Sol and Claude Opus 5.5 of commit 7d26af0ee1d2517560bb46ac5589e921813fb7b8 are complete. Both reviewed the full diff against main independently and found no actionable bugs introduced by this PR.

Coverage included the native Agents, Errors, Cluster, setup and settings pages; their Rust API contracts; routing; permissions; request cancellation and stale results; time ranges and pagination; and network-policy draft handling.

Validation: both reviewers independently ran the five targeted library test files (agents, networkPolicy, operationsContract, settingsCapabilities, classicUi), with 148/148 tests passing in each run. Opus also passed the TypeScript check; Sol passed git diff --check.

This review did not rerun browser, Storybook, production-mount or remote-testbox suites, and did not validate a live distributed server. The broader-suite limitations documented in the PR still apply. No inline findings to report.