feat: RMM Overshell, IT Glue audit/write-back, LogLift, link-aware bundles, dashboard overhaul

- RMM Overshell (migration 077): admin page, dispatch UI, executor/worker, target
  resolver, script registry (AD/DHCP/DNS/event-log/services/software/network/loglift)
- LogLift evidence pipeline (migration 078): upload webhook, B2 storage client,
  receiver/matcher, EventLogCollector PowerShell script
- IT Glue audit + write-back (migrations 075, 076): asset-audit runner, ticket
  xrefs, applications/configurations browse pages + apply/revert/audit endpoints
- Link-aware analyzer bundles (migration 073) + provider toggle (migration 074):
  link-discovery service, OpenRouter LLM provider, related-tickets/itglue-suggestion
  panels, analyze-bundle endpoint
- Endpoint data model + device-link reconciliation (migrations 079, 080): conflicts
  admin page, reconciler service, resolve endpoints
- Dashboard overhaul: integration-health service + alerts, overview/health endpoints
- Permissions: add itglue + rmm scopes; middleware: public /api/rmm/loglift route

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

migrations/078_loglift_uploads.sql

@@ -0,0 +1,43 @@
+-- Phase 4.3 — LogLift event-log ingestion pipeline.
+--
+-- Extends rmm_executions to support B2-uploaded payloads (separate transport
+-- from Overshell stdout) and rmm_settings to cache the LogLift component uid.
+--
+-- transport='overshell_stdout' (default for existing rows) — payload comes
+-- back via Datto getJobResults stdout. The Phase 4.2 path.
+-- transport='b2_upload' — collector script uploads gzipped JSON to B2 and
+-- POSTs a webhook; Pulse downloads + parses asynchronously.
+
+ALTER TABLE rmm_executions
+  ADD COLUMN IF NOT EXISTS transport TEXT NOT NULL DEFAULT 'overshell_stdout'
+    CHECK (transport IN ('overshell_stdout','b2_upload')),
+  ADD COLUMN IF NOT EXISTS evidence_object_key TEXT,
+  ADD COLUMN IF NOT EXISTS run_id TEXT;
+
+-- Used to correlate inbound webhooks to a Pulse-dispatched execution.
+CREATE UNIQUE INDEX IF NOT EXISTS ux_rmm_executions_run_id
+  ON rmm_executions (run_id) WHERE run_id IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS ix_rmm_executions_object_key
+  ON rmm_executions (evidence_object_key) WHERE evidence_object_key IS NOT NULL;
+
+ALTER TABLE rmm_settings
+  ADD COLUMN IF NOT EXISTS loglift_component_uid TEXT,
+  ADD COLUMN IF NOT EXISTS loglift_component_name TEXT,
+  ADD COLUMN IF NOT EXISTS loglift_discovered_at TIMESTAMPTZ;
+
+COMMENT ON COLUMN rmm_executions.transport IS
+  'overshell_stdout (default) — Phase 4.2 path; payload arrives in Datto job stdout. '
+  'b2_upload — Phase 4.3 LogLift; collector uploads gzipped JSON to Backblaze B2 '
+  'and POSTs a webhook. Pulse downloads + parses async.';
+
+COMMENT ON COLUMN rmm_executions.evidence_object_key IS
+  'B2 object key for transport=b2_upload rows. Format: '
+  '{datto_site_uid}/{computer_name}/eventlogs_{timestamp}.json.gz. '
+  'Full payload stays in B2 (encrypted, signed-URL access only); '
+  'parsed_evidence holds a slimmed view.';
+
+COMMENT ON COLUMN rmm_executions.run_id IS
+  'Collector-supplied correlation token. Used by the receiver to match an '
+  'inbound webhook to a Pulse-dispatched execution. NULL for out-of-band '
+  'collector runs.';