feat(dashboard): two-level nav, live ticker, and polish (PR-A)

[surpradhan]

What does this PR do?

Redesigns src/public/dashboard.html across two axes: navigation structure and interaction polish. No backend changes, no new CI job.

Changes

Nav restructure — flat 8-tab bar → 3 primary tabs (Observe / Analyze / Ops) with contextual sub-navs revealed per group. switchGroup() handles primary-tab clicks; syncPrimaryNav() keeps both levels in sync. Hash routing (#sessions, #analytics, etc.) preserved unchanged — existing deep-links continue to work.

Live pill — replaced static "Live" / "Reconnecting…" with a real setInterval ticker: Live · updated Xs ago / Disconnected · last seen Xs ago. Timestamp resets on every event.received SSE tick.

Honest export — export buttons show Preparing… (disabled) for 1.8s then revert. Previously no feedback was given even though window.location.href has no JS completion event.

Clickable metric cards — Sessions, Rejected, Workflows cards act as deep-links to their respective views. Events Received and Accepted have no corresponding view and remain non-clickable.

Actionable empty states — sessions empty state now shows the emit command; workflows empty state explains trace_id grouping.

Type floor — .k (metric card label) and .panel-title raised from 10px → 11px.

Title — "AEP Demo Dashboard" → "AEP Dashboard".

Why?

Part of the UX redesign initiative (PR-A of 4). Reduces cognitive load from a flat 10-item tab bar and fixes several small interaction honesty issues.

How to test?

ADMIN_TOKEN=dev-admin npm run ingest
open http://localhost:8787/dashboard

1. Verify three primary tabs (Observe/Analyze/Ops) with contextual sub-navs
2. Click each primary tab — correct sub-nav appears, correct view loads
3. Navigate to #analytics, #anomalies, #rejected directly — correct tab highlighted
4. Wait 10s idle — live pill shows "Live · updated Xs ago"
5. Click Sessions / Rejected / Workflows metric cards — navigates correctly
6. Select a session and click Export JSON — buttons show "Preparing…" briefly

Checklist

• Tests pass (239/239)
• Single file changed (src/public/dashboard.html)
• No new CI job (stays at 14 required checks)
• Hash routing backward-compatible
• No breaking changes

[surpradhan]

R1 review response

Finding #1 — ARIA tablist without tabpanels (Major → Fixed)
Reverted role="tablist" and role="tab" from all elements. Restored the flat aria-selected hint approach that was on main, with a comment noting the full WAI-ARIA tablist pattern (roving tabindex, arrow keys, tabpanel wiring) remains a tracked follow-up.

Finding #2 — Alert dots unwired (Major → Fixed)
setBadge(total) now sets pdot-ops to alert-warn when total > 0. renderAnomalies(a) now sets pdot-analyze to alert-warn when a.anomaly_count > 0. Both clear the class when the count returns to zero.

Finding #3 — Redundant syncPrimaryNav in switchGroup (Minor → Fixed)
Removed the extra call. switchMain handles it. Added a comment explaining the intentional "clicking an active primary tab resets to group default" behavior.

Finding #4 — _tickerInterval never cleared (Minor → Comment added)
Added a comment in the interval guard noting the single-page context. A full teardown path is not in scope for this PR.

Finding #5 — live-label missing aria-live (Minor → Fixed)
Added role="status" aria-live="polite" aria-atomic="true" to #live-label.

Finding #6/#7 — "Policy" / "Custom" ambiguous labels (Nit → Fixed)
Restored "Policy Analytics" and "Custom Analytics" as sub-tab labels.

[surpradhan]

Round-2 code review: Approve. All R1 findings correctly addressed. Alert dots now wire up in setBadge/renderAnomalies (single source of truth for each count). switchGroup simplified — no redundant syncPrimaryNav call. ARIA role regression reverted. live-label gets role=status. Zero new issues introduced. Gates 239/239.