Reconcile Dynamic history and batch availability reads

[Jordanmuss99]

Summary

• preserve the panel-only dp-20 progress closeout on top of the current GitHub history
• batch location availability through the Pterodactyl location response with included nodes and servers
• group included server allocations by node and remove the obsolete per-node fetch helper
• make the extension test harness work from standalone local checkouts using PAYMENTER_BASE_PATH
• generate a random process-private named in-memory SQLite database from the :temporary: test sentinel, rejecting every caller-supplied path or URI
• reject production-environment and filesystem-alias database guard bypasses
• sanitize customer-facing availability failures and fail closed on malformed, incomplete, negative, orphaned, mismatched-location, or truncated paginated capacity records
• reuse one validated location snapshot throughout the customer endpoint, avoiding duplicate panel reads and cross-snapshot responses
• reject duplicate node, server, and location identities before they can overwrite or double-count capacity records
• reconcile every paginated page count/size/total before accepting capacity data, reject fractional resource values, and use the server-index fallback only when the included relationship is absent
• preserve and reconcile the Qoder source pages with the final batched availability flow

Why

The live panel branch and GitHub dynamic-slider history had diverged. The panel contained one useful progress update plus an uncommitted availability optimization, while GitHub contained newer agent guidance, security assertions, and Qoder Wiki source. This branch carries the useful panel work forward without reintroducing the obsolete AGENTS.md hunk or rewriting the default branch.

The Qoder documentation is also retained and corrected so it no longer describes the removed per-node server-fetch flow. Required Pterodactyl application API permissions are now explicit: Locations, Nodes, and Servers read access.

Validation

• PHP 8.4 syntax checks passed for the changed PHP files
• focused ResourceCalculation, NodeSelection, Availability API, and database-guard suites: 59 tests, 155 assertions
• adversarial database-guard coverage rejects caller-supplied SQLite files and named-memory URIs, empty database names, unsafe connection/environment pairings, and production environments
• standalone SQLite is auto-migrated through a private shared-memory URI while the guard retains an anchor PDO connection; no filesystem path exists to substitute and process teardown discards the database
• explicit request assertions lock location availability to one locations/{id}?include=nodes,servers call
• endpoint and service assertions lock the customer response to one consistent location snapshot
• git diff --check origin/dynamic-slider...HEAD passed

A prior complete-suite SQLite run reached the existing MariaDB-specific failures around JSON_UNQUOTE, DATE_ADD(... INTERVAL ...), and SQLite locking. Those failures are outside this availability/test-bootstrap change; the focused affected suites pass.

PR #22 overlaps this branch and must be fully rebased onto PR #23's head while preserving these safety and Wiki fixes. Production approval requires all three protections from PR #22: its explicit local NodeCapacityPolicy, rejection of Pterodactyl's zero-as-unlimited resource limits, and API-key encryption migration. A partial CPU-only cherry-pick is not deployable. PR #22 must not be merged unchanged because it contains superseded test-guard and error-response behavior.

GitHub Wiki

The separate GitHub Wiki repository was migrated from the Qoder export and pushed independently. Wiki commit 371eb0da950c7c5b420b1b376380669a0a4dc947:

• contains the complete migrated page set and preserves the original remote Home commit in its ancestry
• pins all 2,781 GitHub source links to reviewed code commit 6b7f83bda6f7c3fe014d52428b31af1638daa6cc; all 2,350 displayed ranges match their anchors and resolve within target files
• refreshes the availability diagrams and service references to the final batched location request
• documents required Locations, Nodes, and Servers read permissions
• aligns the generic availability error contract, the single-snapshot customer flow, strict pagination, the admin-only node route, the process-private :temporary: test database, and the CPU-policy deployment gate
• corrects the four corrupted index titles in _manifest.csv
• contains no obsolete fetchServersOnNode or per-node include=servers documentation