Prbatero/feat/data publishing pc - #123

Bucket A only. Adds to api/hastefuncapi/function_app.py: publishing imports,
active-caller/authorization helpers, the DeleteProject published-dataset guard,
and 7 publishing routes (GetPublishingProviders, GetPublishDatasetOptions,
GetPublishedDatasets, GetPublishedDataset, PutPublishDatasetQueueMessage,
PutRetryPublishedDatasetQueueMessage, DeletePublishedDataset). All existing
endpoints reverted to main's versions — the Bucket-B endpoint hardening (IDOR
checks, strict *Request DTOs, server-managed-field enforcement, assessment size
caps) is deferred to a separate -hardening PR.

Tests: 19 publishing route tests + 6 queue-handler tests pass. Existing core
suite: 191 pass (3 failures are pre-existing on main — clipBbox mocks).

Bucket A UI, gated behind the publishingEnabled flag:
- New: PublishedDatasets section, PublishedDatasetRow, PublishDatasetModal
  (name/description prefill, asset checklist, provider-driven target dropdown),
  util/publishing.js, util/assessmentSummary.js (extracted from AssessmentReportModal).
- Additive wiring: App/AppContext (publishingEnabled + provider fetch),
  AppBody route + AppSidebar nav, "Publish dataset..." in ModelResultsButton +
  EmbeddingModelRow, Database icon.
- api.js: apiPut/apiDelete now accept any 2xx (async 202 queue responses) —
  minimal additive change; the shared-helper ApiError rewrite is NOT taken
  (deferred to -hardening). Existing 200 callers unaffected.

Validated: full `vite build` compiles cleanly (all imports resolve). Vitest
unit tests + config are preserved on -sol/archive and land in a follow-up
UI-test-infra slice (needs vitest devDeps + package-lock regen).

UI (Published Datasets section):
- Clickable Project/Layer cell -> opens the source project with that layer
  expanded (/project/:projectId/:imageLayerId).
- Labeled "Actions" button (replacing the bare "...") and an "Actions" column
  header; keep the menu (download / open in Explorer / retry / unpublish).
- New "View details" action -> modal with the generated description, project/
  layer, model, target, status, publisher, headline assessment stats, and the
  published assets (kind + size).
- "Published by" now mirrors the project Creator display: the publisher's
  login/email via limitTextLength, not the opaque object id.
- Desktop column widths moved into a @media (min-width: 993px) rule scoped to
  .pgrid-page--published-datasets so the mobile card layout (inherited from
  .pgrid-page--model-catalog) is preserved; font URLs forced to https (CSP).

Backend:
- Capture the publisher's display name (client-principal userDetails) at publish
  time as PublishedDataset.publishedByName, so the UI can show a human name while
  the ownership check still uses the object id.

Add the data-publishing feature flag and queue name to the api/queues
Function App settings so the Local target runs in Azure:

- functions.bicep: PUBLISH_QUEUE_NAME ('publish-queue') and
  PUBLISHING_ENABLED (from a new publishingEnabled param) in appConfigSettings.
- main.bicep / main.bicepparam: publishingEnabled param, default off,
  sourced from HASTE_PUBLISHING_ENABLED.

The publish-queue and the publishing-locks blob container are auto-created at
runtime, and APIM operations are auto-synced from the deployed function app by
the postdeploy hook, so no queue/container/APIM resources are needed here.
Other Local knobs (PUBLISH_MAX_TOTAL_BYTES, PUBLISHED_DOWNLOAD_SAS_MINUTES,
PUBLISHING_LOCK_CONTAINER) use code defaults.

Note: infra/main.json (compiled ARM artifact) is intentionally not regenerated
here to avoid a bicep CLI-version reformat; regenerate it with the repo's
pinned bicep version.

Add the publishing feature flag + queue/lock settings to the api and queues
services so `docker compose up` exercises Local publishing against Azurite
(the publish-queue and publishing-locks container auto-create at runtime).
PC_PROVIDER_ENABLED stays false — no local GeoCatalog.

Drop the accidental "install" and "npm" entries from the UI dependencies (and
their lockfile trees). Neither is imported anywhere; the npm CLI as a runtime
dependency is what caused local image builds to fetch an npm tarball. Mirrors
the earlier cleanup in #64 before they regressed back in.

… deploy paths

The Config drift check failed with:

  Dead application settings (set but never read):
    PUBLISHING_ENABLED  (set by infra/modules/functions.bicep, read by no code)

That was a false positive. PUBLISHING_ENABLED is read in hastegeo.core.config
via _get_bool_env("PUBLISHING_ENABLED", False), but check_env_drift.py's AST
scanner only recognized os.getenv, os.environ.get, and os.environ[...]. The new
typed wrappers _get_bool_env and _get_bounded_int_env were invisible to it, so
no reader was found and the setting looked dead.

The blind spot covered five variables, not one: PC_PROVIDER_ENABLED,
PUBLISH_MAX_TOTAL_BYTES, PUBLISHED_DOWNLOAD_SAS_MINUTES and PC_VERIFY_ATTEMPTS
are read through the same helpers and were equally unseen. They simply did not
error because no deploy path emits them yet.

Teach the scanner to treat _get_*_env(NAME, ...) calls as reads. The wrappers
supply their own default in the signature, so such a read counts as optional
even when the call site passes no default.

Separately, fix the real drift the check could not see: PUBLISHING_ENABLED was
emitted by functions.bicep but not by deploy_apps.sh, so environments deployed
through the GitHub Actions path would never receive it and would silently fall
back to false while Bicep-provisioned environments got the flag. Emit it from
deploy_apps.sh too, defaulting off to match the Bicep param, and wire it
through deploy-apps.yml as a GitHub Environment variable (non-sensitive feature
flag, same treatment as VITE_SHOW_FOOTER).

Phase 2, stacked on -local. Adds the Planetary Computer publishing target using
a vendored REST GeoCatalog client instead of the azure-planetarycomputer SDK —
offline-verifiable, no proprietary-SDK coupling (per the spec decision).

- geocatalog_client.py: hardened REST client + Entra auth (scope
  .../.default), redirect suppression, per-request timeouts, sanitized errors
  (never embeds server response bodies), api-version 2026-04-15.
- planetary_computer_transport.py: resumable one-request-per-step adapter
  (start/continue create-collection/item, delete-item; get collection/item/
  ingestion-source; asset signing) satisfying the provider's interface. Carries
  over the SSRF operation-URL pinning, endpoint validation, and failed-item
  accounting; FIXES the "Finished" terminal-status bug (was failing good
  ingests). Handles synchronous (201) collection creation vs async (202) items.
- planetary_computer_provider.py + stac.py + schemas/: the resumable bounded-
  step provider and STAC builder (item geometry from the valid-area mask,
  ai4g: stats, one collection per project) reused verbatim from the audited
  implementation; provider gains a branch for sync collection creation.
- config: PC_VERIFY_ATTEMPTS default 5->20 (bound 60). Continue-steps re-enqueue
  at ~30s, so this is a ~10 min default (30 min max) ingestion budget.
- pyproject: planetary-computer extra -> vendored-REST deps (azure-identity,
  requests, pystac[validation], geopandas, pyogrio, pyproj, shapely).

Tests: 97 publishing unit tests (incl. 16 new transport HTTP-fixture tests:
SSRF pinning, Finished, failed-items, sanitization, sync/async, 404/409) + 25
API tests pass. Registry lazy-loads the provider and PC is disabled by default,
so -local is unaffected when PC is off.

Follow-up: end-to-end verification against a live GeoCatalog (confirm the
/sas/sign asset-signing endpoint and sync-vs-async collection creation).

…ion role

Stacked on the Local publishing infra wiring; adds the PC-target configuration
so the Planetary Computer provider runs in Azure:

- functions.bicep: PC_PROVIDER_ENABLED, PC_GEOCATALOG_URL, PC_EXPLORER_URL,
  PC_INGESTION_SOURCE, PC_COLLECTION_PREFIX app settings (new pc* params).
  The api-version and Entra token scope are code constants, not settings; auth
  is managed-identity only.
- main.bicep / main.bicepparam: pc* params, default off/unset, sourced from
  HASTE_PC_* env vars. The GeoCatalog itself is operator-provisioned/external.
- roles.bicep: conditional Storage Blob Data Reader on the HASTE storage
  account for an operator-supplied GeoCatalog ingestion managed identity
  (asset ingestion). Off by default (empty principal id); not needed for public
  containers or the SasToken ingestion path.

The complementary grant (function-app identity on the external GeoCatalog data
plane) is operator-owned and configured out-of-band; the exact GeoCatalog RBAC
role needs verification against a live catalog before wiring.

Note: infra/main.json (compiled ARM) not regenerated here to avoid a bicep
CLI-version reformat; regenerate with the repo's pinned bicep version.

Resolve Copilot review findings on the Planetary Computer target:

- Ingestion source is optional (public-container mode): the provider's info
  isConfigured and _require_configuration no longer require a non-empty
  PC_INGESTION_SOURCE, and start_publish only validates the source when one is
  set. A GeoCatalog URL alone now configures the target — matching the spec, the
  Bicep param, and verified live behavior (public blobs ingest without a source).
- GeoCatalog client no longer appends api-version to absolute operation URLs
  that already carry it, avoiding a duplicate api-version query parameter on
  ingestion-operation polling.
- deploy_apps.sh (GitHub Actions deploy path) now emits the PC_* Function App
  settings (PC_PROVIDER_ENABLED, PC_GEOCATALOG_URL, PC_EXPLORER_URL,
  PC_INGESTION_SOURCE, PC_COLLECTION_PREFIX) to match infra/modules/functions.bicep.
- Remove the unused azure-planetarycomputer dependency from hastefuncqueues
  (the implementation uses the vendored REST client, not the SDK).

Also aligns the provider's PC_VERIFY_ATTEMPTS upper bound (was 20) with the
config's allowed maximum (60), so operator overrides above 20 no longer fail
validation at publish time.