feat: consolidate database management work

Add catalog-owned logical relationships and runtime snapshots, extend the database-management UI and validation coverage, and document the updated operational workflow.

Keep active sensitive-generation status in a tooltip and indicator, and update the layout E2E to follow the history action in its new database-scoped location.

backend/test/catalog-databases-routes.test.ts

@@ -13,7 +13,10 @@ import type { WorkspaceRegistry, WorkspaceRevision } from "../src/workspaces/reg
 import type { WorkspaceDescriptor } from "../src/workspaces/schema.js";
 
 const roots: string[] = [];
-afterEach(() => { for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true }); });
+afterEach(() => {
+  vi.unstubAllEnvs();
+  for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
 
 const workspace: WorkspaceDescriptor = {
   workspace: { schema_version: 3, id: "psd-clinical", name: "Policlinico San Donato", language: "it" },
@@ -36,6 +39,7 @@ function setup(
     catalogOperationCoordinator?: CatalogOperationCoordinator;
     catalogPostgresAccess?: CatalogPostgresAccess;
   } = {},
+  workspaceDescriptor: WorkspaceDescriptor = workspace,
 ) {
   const secretRoot = mkdtempSync(join(tmpdir(), "catalog-secret-"));
   const runtimeRoot = mkdtempSync(join(tmpdir(), "catalog-secret-runtime-"));
@@ -45,7 +49,8 @@ function setup(
   const registry = {
     list: vi.fn(async () => [revision]),
     listCatalog: vi.fn(async () => [{ id: "psd-clinical", name: "Policlinico San Donato", configurationState: "ready", revision }]),
-    read: vi.fn(async () => ({ workspace, revision })),
+    read: vi.fn(async () => ({ workspace: workspaceDescriptor, revision })),
+    readPinned: vi.fn(async () => ({ workspace: workspaceDescriptor, workspaceConfigPath: revision.snapshotPath })),
   } as unknown as WorkspaceRegistry;
   const app = buildApp(loadConfig({
     THT_HARNESS_DIR: "/missing",
@@ -96,10 +101,31 @@ const fleetSnapshot: ObservedSchemaSnapshot = {
 };
 
 test("lists every YAML workspace and creates its one database configuration", async () => {
-  const { app } = setup();
+  const { app, secretStore } = setup();
   const initial = await app.inject({ method: "GET", url: "/catalog/databases" });
   expect(initial.statusCode).toBe(200);
-  expect(initial.json()).toMatchObject([{ workspaceId: "psd-clinical", configured: false, databaseName: "warehouse" }]);
+  expect(initial.json()).toMatchObject([{
+    workspaceId: "psd-clinical",
+    configured: false,
+    databaseName: "warehouse",
+    workspaceRevision: { commit: revision.commit, blob: revision.blob },
+    workspaceEvidence: { sourceType: null, state: "not_declared" },
+    runtimeBinding: {
+      transport: "postgres_direct",
+      configurationState: "configuration_required",
+      sessionTransportSupported: true,
+    },
+  }]);
+
+  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_HOST", "runtime-db.internal");
+  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_PORT", "5432");
+  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_USER", "runtime-reader");
+  vi.stubEnv("THT_WS_PSD_CLINICAL_DWH_TRANSPORT", "postgres_direct");
+  secretStore.putMany("psd-clinical", { "dwh.password": "runtime-password" });
+  const runtimeReady = await app.inject({ method: "GET", url: "/catalog/databases" });
+  expect(runtimeReady.json()).toMatchObject([{
+    runtimeBinding: { configurationState: "ready", sessionTransportSupported: true },
+  }]);
 
   const created = await app.inject({ method: "POST", url: "/catalog/databases", payload: direct });
   expect(created.statusCode).toBe(201);
@@ -110,6 +136,39 @@ test("lists every YAML workspace and creates its one database configuration", as
   expect(listed.json()).toMatchObject([{ configured: true, binding: { transport: "postgres_direct", host: "db.internal" } }]);
 });
 
+test("projects remote Evidence credential state without conflating catalog secrets", async () => {
+  const evidenceWorkspace: WorkspaceDescriptor = {
+    ...workspace,
+    evidence: {
+      schema_version: 2,
+      source: {
+        type: "http",
+        uris: ["https://evidence.example.test/guide.md"],
+        authentication: "signed_urls_file",
+        connect_timeout_ms: 5_000,
+        read_timeout_ms: 30_000,
+        max_bytes: 10 * 1024 * 1024,
+        max_redirects: 5,
+        allow_private_hosts: false,
+        max_cache_bytes: 64 * 1024 * 1024,
+      },
+      policy: { max_chunk_chars: 4_000, retain_published_generations: 3 },
+    },
+  };
+  const { app, secretStore } = setup({}, {}, evidenceWorkspace);
+
+  const missing = await app.inject({ method: "GET", url: "/catalog/databases" });
+  expect(missing.json()).toMatchObject([{
+    workspaceEvidence: { sourceType: "http", state: "configuration_required" },
+  }]);
+
+  secretStore.putMany("psd-clinical", { "evidence.signed_urls": "https://signed.example.test/evidence" });
+  const configured = await app.inject({ method: "GET", url: "/catalog/databases" });
+  expect(configured.json()).toMatchObject([{
+    workspaceEvidence: { sourceType: "http", state: "configured_unverified" },
+  }]);
+});
+
 test("lists orphaned records and takes the REST diagnostic path from workspace YAML", async () => {
   const { app, repository } = setup();
   await repository.create({