feat: RMM Overshell, IT Glue audit/write-back, LogLift, link-aware bundles, dashboard overhaul

- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target
  resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift)
- LogLift evidence pipeline (migration 078): upload webhook, B2 storage client,
  receiver/matcher, EventLogCollector PowerShell script
- IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket
  xrefs, applications/configurations browse pages + apply/revert/audit endpoints
- Link-aware analyzer bundles (migration 073) + provider toggle (migration 074):
  link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion
  panels, analyze-bundle endpoint
- Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts
  admin page, reconciler service, resolve endpoints
- Dashboard overhaul: integration-health service + alerts, overview/health endpoints
- Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

migrations/073_analyzer_link_aware_bundles.sql

@@ -0,0 +1,44 @@
+-- AI Ticket Analyzer — link-aware bundle support.
+-- See docs/wulf-pulse-ticket-analyzer-build-notes.md (Phase 3).
+--
+-- A "bundle" is an aggregate report that was triggered from a single ticket
+-- analysis page (typically a master/problem ticket) and is waiting for the
+-- per-ticket analyses of its referenced tickets to complete before it can run.
+--
+-- Adds:
+--   1. expected_ticket_numbers TEXT[]   — the full set the bundle is waiting on
+--   2. triggered_by_ticket_number TEXT  — the master ticket the user clicked from
+--   3. New status value 'pending_analyses' — set while underlying analyses are
+--      still running. Worker chain-trigger flips it to 'pending' once all
+--      expected tickets have a complete analysis, then runAggregateReport runs.
+
+ALTER TABLE analyzer_aggregate_reports
+  ADD COLUMN IF NOT EXISTS expected_ticket_numbers TEXT[],
+  ADD COLUMN IF NOT EXISTS triggered_by_ticket_number TEXT;
+
+ALTER TABLE analyzer_aggregate_reports
+  DROP CONSTRAINT IF EXISTS analyzer_aggregate_reports_status_check;
+
+ALTER TABLE analyzer_aggregate_reports
+  ADD CONSTRAINT analyzer_aggregate_reports_status_check
+  CHECK (status IN ('pending','pending_analyses','running','complete','failed'));
+
+-- Replace the existing partial index so chain-trigger queries are still fast.
+DROP INDEX IF EXISTS idx_analyzer_aggregate_reports_pending;
+CREATE INDEX IF NOT EXISTS idx_analyzer_aggregate_reports_pending
+  ON analyzer_aggregate_reports (status, generated_at)
+  WHERE status IN ('pending','pending_analyses','running');
+
+-- Worker chain-trigger looks up reports waiting on a specific ticket number.
+CREATE INDEX IF NOT EXISTS idx_analyzer_aggregate_reports_expected_tickets
+  ON analyzer_aggregate_reports USING gin (expected_ticket_numbers)
+  WHERE status = 'pending_analyses';
+
+COMMENT ON COLUMN analyzer_aggregate_reports.expected_ticket_numbers IS
+  'For bundles created from a master ticket: the full set of ticket numbers whose '
+  'analyses must complete before the aggregate-reduce step runs. NULL for legacy '
+  'aggregate reports created by manual multi-select.';
+
+COMMENT ON COLUMN analyzer_aggregate_reports.triggered_by_ticket_number IS
+  'The ticket number the bundle was launched from (the master in a problem-ticket '
+  'flow). NULL for legacy reports.';