feat: consolidate database management work

Add catalog-owned logical relationships and runtime snapshots, extend the database-management UI and validation coverage, and document the updated operational workflow.

Keep active sensitive-generation status in a tooltip and indicator, and update the layout E2E to follow the history action in its new database-scoped location.

frontend/src/shell/AppShell.database-management.test.tsx

@@ -17,6 +17,10 @@ function renderShell() {
   );
 }
 
+async function expandAdministration() {
+  await userEvent.click(screen.getByRole("button", { name: "Administration" }));
+}
+
 beforeEach(() => {
   clearAuthState();
   setAuthState({
@@ -92,10 +96,19 @@ test("uses Fleet Ledger by default and gates the legacy fallback to non-producti
 
 test("replaces the core conversation while keeping the session navigation", async () => {
   renderShell();
+  await expandAdministration();
 
   const conversationColumn = screen.getByTestId("conversation-column");
   const sessionNavigation = screen.getByRole("complementary", { name: "Session navigation" });
+  const newSession = within(sessionNavigation).getByRole("button", { name: "New session" });
   const databaseManagement = within(sessionNavigation).getByRole("button", { name: "Database management" });
+
+  expect(newSession).toHaveAttribute("aria-current", "page");
+  expect(newSession).toHaveAttribute("data-navigation-state", "current");
+  expect(newSession).toHaveClass("bg-[oklch(var(--nav-active))]");
+  expect(databaseManagement).toHaveAttribute("data-navigation-state", "available");
+  expect(databaseManagement).not.toHaveAttribute("aria-current");
+
   await userEvent.click(databaseManagement);
 
   const manager = screen.getByRole("main", { name: "Database management" });
@@ -103,8 +116,13 @@ test("replaces the core conversation while keeping the session navigation", asyn
   expect(conversationColumn).toContainElement(manager);
   expect(screen.getByRole("complementary", { name: "Session navigation" })).toBe(sessionNavigation);
   expect(sessionNavigation).toBeVisible();
-  expect(within(sessionNavigation).getByRole("button", { name: "New session" })).toBeVisible();
+  expect(newSession).toBeVisible();
+  expect(newSession).toHaveAttribute("data-navigation-state", "available");
+  expect(newSession).not.toHaveAttribute("aria-current");
+  expect(newSession).not.toHaveClass("bg-[oklch(var(--nav-active))]");
   expect(databaseManagement).toHaveAttribute("aria-current", "page");
+  expect(databaseManagement).toHaveAttribute("data-navigation-state", "current");
+  expect(databaseManagement).toHaveClass("bg-[oklch(var(--nav-active))]");
   expect(screen.queryByRole("button", { name: "Back to workspace" })).not.toBeInTheDocument();
   expect(screen.queryByRole("textbox", { name: /new question/i })).not.toBeInTheDocument();
 });
@@ -135,6 +153,7 @@ test("keeps a live core session connected while returning from database manageme
     })),
   );
   renderShell();
+  await expandAdministration();
 
   const session = await screen.findByTestId("session-item-s1");
   await userEvent.click(session);
@@ -157,7 +176,7 @@ test("keeps a live core session connected while returning from database manageme
   expect(FakeEventSource.instances).toHaveLength(1);
 });
 
-test("keeps read-safe workspace access but hides privileged management entries", () => {
+test("hides the complete administrative navigation from a regular user", () => {
   clearAuthState();
   setAuthState({
     issuer: "test",
@@ -171,7 +190,9 @@ test("keeps read-safe workspace access but hides privileged management entries",
 
   renderShell();
 
-  expect(screen.getByRole("button", { name: "Workspace management" })).toBeInTheDocument();
+  expect(screen.getByRole("button", { name: "New session" })).toBeInTheDocument();
+  expect(screen.queryByRole("button", { name: "Administration" })).not.toBeInTheDocument();
+  expect(screen.queryByRole("button", { name: "Workspace management" })).not.toBeInTheDocument();
   expect(screen.queryByRole("button", { name: "Database management" })).not.toBeInTheDocument();
   expect(screen.queryByRole("button", { name: "Pi management" })).not.toBeInTheDocument();
 });
@@ -182,6 +203,13 @@ test("does not leave database management without confirming a dirty form", async
     workspaceId: "psd-clinical",
     workspaceName: "Policlinico San Donato",
     workspaceAvailable: true,
+    workspaceRevision: { commit: "a".repeat(40), blob: "b".repeat(40) },
+    workspaceEvidence: { sourceType: "filesystem", state: "materialized_current_revision" },
+    runtimeBinding: {
+      transport: "postgres_direct",
+      configurationState: "ready",
+      sessionTransportSupported: true,
+    },
     configured: true,
     engine: "postgres",
     databaseName: "warehouse",
@@ -202,6 +230,7 @@ test("does not leave database management without confirming a dirty form", async
   }])));
   const confirm = vi.spyOn(window, "confirm").mockReturnValue(false);
   renderShell();
+  await expandAdministration();
 
   await userEvent.click(screen.getByRole("button", { name: "Database management" }));
   await userEvent.click(await screen.findByRole("button", { name: "Edit Policlinico San Donato" }));