feat: add source sync observability

[jonathanhaaswriter]

Summary

• add typed per-source sync status, sync-now, and backfill RPCs
• aggregate Google Reports, BigQuery, Directory, OAuth, and ingestion queue state
• surface source health and recovery controls in the connectors UI
• add wake listeners for Directory and OAuth sync workers

Validation

• npm run db:generate
• npm run db:validate
• npm run typecheck
• npm run guardrails:migration
• npm run test:api
• npm run proto:check
• go test ./...
• make lint
• npm run build:web

Note: make test-go-db could not run locally because Docker/Colima is not running (missing /Users/jonathan/.colima/default/docker.sock).

[github-actions]

Droid encountered an error —— View job

---

Droid is reviewing code and running a security check…

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated 4 candidates and approved all 4. The source-level observability work is valuable, but the PR still has real regressions around rate limiting, wake-triggered sync behavior and error reporting, and dialog availability on unhealthy Google Workspace connectors.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated 3 candidates and approved all 3. The new source observability surface still has real correctness gaps: per-source Sync ignores the selected stream, queued backfills look successful before workers run, and failed Directory or OAuth sweeps can appear current even when the underlying data is stale.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated all 3 review candidates for PR #103 and wrote /home/runner/work/_temp/droid-prompts/review_validated.json.

Approved and posted 3 batched review comments:

• connector freshness still advances after single-stream Reports or BigQuery runs
• -once workers can still drop later wake notifications while draining
• source sync still accepts stream names that Directory and OAuth workers cannot honor

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated 4 candidates and approved all 4. The source-level observability work is valuable, but the PR still has actionable correctness gaps around dialog state races, durable backfill queuing, wake-listener error handling, and BigQuery queue attribution.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated 1 candidate and approved 1.

Sync all still has a real ordering bug: it can wake OAuth before Directory refreshes identities, which makes Shadow IT look current while omitting grants until a later OAuth run.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated all 2 review candidates for PR #103 and wrote /home/runner/work/_temp/droid-prompts/review_validated.json.

Approved and posted 2 batched review comments:

• Reports per-stream setup failures can leave queued or stale-success state behind
• BigQuery setup failures can leave queued backfills stuck forever

Overall assessment: the source-level observability work is useful, but the PR still hides real wake-triggered setup failures for Reports and BigQuery streams.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated all 3 review candidates for PR #103 and wrote /home/runner/work/_temp/droid-prompts/review_validated.json.

Approved and posted 3 batched review comments:

• once-mode wake draining can abort active sync work after a listener error
• Sync all stays clickable for the wrong connector while another sync is queueing
• errored source rows can regress seen counts to 0

Overall assessment: the source-level observability work is useful, but the PR still has actionable correctness gaps in once-mode wake draining, cross-connector Sync all state, and errored source row-count reporting.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated all 2 review candidates for PR #103 and wrote /home/runner/work/_temp/droid-prompts/review_validated.json.

Approved and posted 2 batched review comments:

• per-source busy state can be lost across concurrent row actions
• once-mode OAuth wake draining can cancel long-running manual syncs after 60 seconds

Overall assessment: The source observability work is useful, but the PR still has two actionable correctness gaps in concurrent row actions and once-mode OAuth wake handling.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

Validated 1 candidate and approved it. The new source-level sync UI still exposes a real correctness gap: OAuth sync can be manually queued before Directory has seeded identities, which makes Shadow IT look current without scanning any users.

[github-actions]

Droid finished @jonathanhaaswriter's task —— View job

---

I validated the lone remaining candidate and rejected it, so no new review comments were posted. The claimed same-row double-click race is not a high-confidence bug because React flushes the busy-state update between discrete clicks, and existing review feedback already covered the real busy-state regression this patch fixed.