feat(web): integration-hub + wizard wiring for local-setup flow

Integration hub: extends integration.models with fields needed by the wizard
(capabilities, credentials, readiness), updates the shell and list components,
adds routing for the new hub flow, and broadens the integration-list spec.

Integration wizard: new integrations-hub.component, extended wizard with
capability/credential handling, updated template + type models, and broader
spec coverage.

Sprint docs: SPRINT_20260413_003 (UI-driven local setup rerun) updated with
wiring notes; SPRINT_20260410_001 (no-mocks) adjusted. ReleaseOrchestrator
architecture doc gets a minor clarification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/implplan/SPRINT_20260410_001_Web_runtime_no_mocks_real_backend.md

@@ -74,22 +74,41 @@ Completion criteria:
 - [ ] Targeted automated tests covering the changed runtime path pass or fail with concrete blockers recorded.
 - [ ] Remaining cross-module runtime in-memory bindings are logged with next-action notes.
 
+### NOMOCK-005 - Replace live script compatibility and Platform script alias stubs with the real scripts registry
+Status: DONE
+Dependency: NOMOCK-001
+Owners: Developer
+Task description:
+- Remove the unconditional compatibility success stub from the owning Release Orchestrator `/api/v2/scripts/{id}/check-compatibility` endpoint and replace it with evaluation against persisted script metadata, requested target metadata, and declared secret availability.
+- Replace the Platform direct `IScriptService` registration with the real Release Orchestrator scripts library when PostgreSQL is configured so the alias path is no longer backed by the local in-memory catalog.
+- Carry declared script variables through create/update paths so compatibility checks operate on real persisted inputs instead of silently dropping UI-authored variable declarations.
+
+Completion criteria:
+- [x] Release Orchestrator script compatibility no longer returns unconditional success.
+- [x] Platform binds `IScriptService` to the real scripts registry when PostgreSQL is available.
+- [x] Script create/update paths persist declared variables through the owning backend.
+- [x] Targeted backend tests cover the compatibility evaluator, variable persistence, and Platform alias mapping.
+
 ## Execution Log
 | Date (UTC) | Update | Owner |
 | --- | --- | --- |
 | 2026-04-10 | Sprint created to remove live production-path stubs, mock providers, and in-memory runtime bindings starting with the active Angular app configuration and Concelier feed-mirror surfaces. | Developer |
 | 2026-04-13 | Inventory extended beyond the initial Concelier slice. Confirmed `/ops/operations/feeds/mirror/*` now runs on persisted Concelier state, but found two still-live script-path fictions: Platform still registers `IScriptService` to `InMemoryScriptService` in `src/Platform/StellaOps.Platform.WebService/Program.cs`, and the owning Release Orchestrator `/api/v2/scripts/{id}/check-compatibility` endpoint still returns an unconditional stub success from `src/ReleaseOrchestrator/__Apps/StellaOps.ReleaseOrchestrator.WebApi/Endpoints/ScriptsEndpoints.cs`. Next implementation slice expands to `src/ReleaseOrchestrator/**` for script compatibility truthfulness and to the Platform alias only if still needed after the owning-service fix. | Developer |
+| 2026-04-13 | Completed the scripts runtime slice. Release Orchestrator now evaluates `/api/v2/scripts/{id}/check-compatibility` against persisted script language, variables, dependencies, target metadata, and available secrets; create/update requests now persist declared variables instead of dropping them; and Platform now binds `IScriptService` to the real Release Orchestrator scripts registry when PostgreSQL is configured. Targeted tests passed: `StellaOps.ReleaseOrchestrator.Integration.Tests` `20/20`, `StellaOps.Platform.WebService.Tests` class-targeted `ReleaseOrchestratorScriptServiceTests` `2/2`, and `ReleaseOrchestrator.WebApi` rebuilt cleanly. Live frontdoor verification was blocked in this shell because the local stack was not running (`docker ps` empty, `curl.exe -k https://stella-ops.local/` connection failure). | Developer |
 
 ## Decisions & Risks
 - Decision: this sprint prioritizes live runtime paths the browser can currently reach over test-only mock helpers.
 - Decision: unsupported operations must return truthful empty/problem responses rather than seeded demo success/error payloads.
 - Decision: after the feed-mirror cleanup, the next highest-value runtime slice is the scripts compatibility path because the browser uses the real `/api/v2/scripts` backend and its compatibility action still reports fabricated success.
+- Decision: the Platform direct scripts alias now reuses the Release Orchestrator scripts library and schema instead of keeping a separate in-memory implementation when PostgreSQL is configured.
 - Risk: several modules outside the initial slice still boot with runtime in-memory stores (`Notify`, `Graph`, `Policy`, `Platform`, `Scheduler`, `Scanner`, `BinaryIndex`, `Signals`, `SbomService`, `Signer`, `PacksRegistry`, `AdvisoryAI`). They will need follow-on slices unless a real persistence path already exists and can be wired safely.
-- Risk: Platform still contains a production registration of `IScriptService -> InMemoryScriptService`, but the live frontdoor currently routes `/api/v2/scripts` to Release Orchestrator. Removing that alias safely requires checking any direct Platform callers so the owning-service fix lands first.
+- Risk: Platform still falls back to `InMemoryScriptService` when no PostgreSQL connection string is configured. That preserves non-database test/dev paths, but it means the cleanup is not repo-wide complete yet.
+- Risk: the live browser path for this slice could not be reverified from the shell because the local stack was down during close-out (`docker ps` returned no running containers). The code-level and project-level checks are green, but live redeploy verification still needs a running stack.
 - Risk: some feed-mirror sub-features appear to have no real persisted backend contract yet, so removing fake data may temporarily surface explicit `501`/empty-state behavior in the UI until the owning backend is implemented.
 
 ## Next Checkpoints
 - Remove the active Angular VEX Hub mock provider.
 - Convert the Concelier feed-mirror endpoints from seeded data to real source/read-model state.
 - Replace the Release Orchestrator script compatibility stub with persisted script-aware evaluation.
+- Re-run the live scripts UI and compatibility panel once the local stack is back up.
 - Re-test the live feed pages and record the next runtime cleanup slice.

docs/implplan/SPRINT_20260413_003_Web_ui_driven_local_setup_rerun.md

@@ -34,7 +34,7 @@ Completion criteria:
 - [ ] `https://stella-ops.local` becomes reachable again for browser-driven setup.
 
 ### UISETUP-002 - Drive the operator setup through the browser UI
-Status: TODO
+Status: DOING
 Dependency: UISETUP-001
 Owners: Developer / QA
 Task description:
@@ -66,6 +66,9 @@ Completion criteria:
 | 2026-04-13 | Removed all `stellaops-*` containers, `compose_*` / `stellaops_*` volumes, the `stellaops` / `stellaops_frontdoor` networks, and all `stellaops/*:dev` images to return the machine to zero Stella runtime state before the rerun. | Developer |
 | 2026-04-13 | Started the documented machine-level bootstrap with `scripts/setup.ps1 -QaIntegrationFixtures`; this restores the platform and fixture-backed frontdoor but not the full real-provider integrations compose lane. | Developer |
 | 2026-04-13 | Code inspection ahead of the live browser run found two likely UI-path gaps to validate: the setup wizard backend persists much of its state only in-session, and the integrations onboarding wizard currently requires a non-empty `AuthRef URI` even though the backend API itself accepts null auth refs for local no-auth connectors. | Developer |
+| 2026-04-13 | The initial `scripts/setup.ps1 -QaIntegrationFixtures` run failed in the repo-wide `.sln` preflight with `MSB4166` child-node exits on `src/Tools/StellaOps.Tools.sln`, `src/VexHub/StellaOps.VexHub.sln`, and `src/Zastava/StellaOps.Zastava.sln`; reran the documented setup entrypoint with `-SkipBuild` to continue the actual local stack bring-up. | Developer |
+| 2026-04-13 | Patched the Integrations Hub UI to expose the missing local onboarding categories (`Secrets`, `Feed Mirrors`, `Object Storage`) and aligned wizard validation with the backend contract so optional-auth / optional-scope local connectors can be created from the browser instead of being blocked by frontend-only rules. | Developer |
+| 2026-04-13 | Angular compile validation for the changed UI surfaces completed without new errors from the modified files; the remaining `ng test` failures are pre-existing audit-log and scheduler test breakages outside the Integrations working slice. | Developer |
 
 ## Decisions & Risks
 - Decision: this rerun uses the real browser UI as the operator surface and treats CLI/bootstrap helpers only as fallback evidence if the product lacks a true UI path.

docs/modules/release-orchestrator/architecture.md

@@ -4,7 +4,7 @@
 
 **Status:** Active Development (backend substantially implemented; API surface layer in progress)
 
-> **Implementation reality (updated 2026-04-10):** The backend is substantially complete with 140,000+ lines of production code across 49 projects. Core libraries (Release, Promotion, Deployment, Workflow, Evidence, PolicyGate, Progressive, Federation, Compliance) are implemented with comprehensive tests (283 test files, 37K lines). Six agent types are operational (Compose, Docker, SSH, WinRM, ECS, Nomad). Compatibility HTTP surfaces now exist across Platform, JobEngine, and Scanner for environment management, deployment monitoring, evidence inspection, dashboard promotion decisions, and registry search. The standalone WebApi now owns and auto-migrates the `scripts` PostgreSQL schema used by `/api/v2/scripts`, so fresh local installs no longer depend on Scheduler-owned SQL bootstrap for the scripts catalog. **Remaining gaps:** the dedicated Release Orchestrator WebApi host is still incomplete, and many compatibility surfaces still rely on in-memory storage outside the scripts catalog and audit/first-signal persistence.
+> **Implementation reality (updated 2026-04-13):** The backend is substantially complete with 140,000+ lines of production code across 49 projects. Core libraries (Release, Promotion, Deployment, Workflow, Evidence, PolicyGate, Progressive, Federation, Compliance) are implemented with comprehensive tests (283 test files, 37K lines). Six agent types are operational (Compose, Docker, SSH, WinRM, ECS, Nomad). Compatibility HTTP surfaces now exist across Platform, JobEngine, and Scanner for environment management, deployment monitoring, evidence inspection, dashboard promotion decisions, and registry search. The standalone WebApi owns and auto-migrates the `scripts` PostgreSQL schema used by `/api/v2/scripts`, and the scripts compatibility endpoint now evaluates persisted script metadata, declared variables, dependency inventory, target metadata, and available secrets instead of returning a fabricated success response. **Remaining gaps:** the dedicated Release Orchestrator WebApi host is still incomplete, and many compatibility surfaces still rely on in-memory storage outside the scripts catalog and audit/first-signal persistence.
 
 ## Overview