feat(modernization): Next.js planning console + JWT/WS API + engine fixes + Helm staging

.clang-tidy

@@ -0,0 +1,28 @@
+# Engine track E1 - static-analysis baseline. The point is bug-finding (the
+# "rewrite oracle"), not style: clang-analyzer-* (the path-sensitive analyzer -
+# null derefs, leaks, uninitialised reads) + the high-signal bugprone-* checks.
+# Style/readability/modernize families are deliberately OFF to keep the signal
+# high on a large, mature C++23 codebase. Two bugprone checks are also off as
+# high-volume/low-signal here: unhandled-self-assignment (fires on every operator=
+# lacking a self-check - defensive, not a bug) and exception-escape (legacy
+# destructors). The gate is advisory (engine-clang-tidy.yml) and reports counts;
+# it tightens to "no NEW findings" once the baseline is triaged.
+Checks: >
+  -*,
+  clang-analyzer-*,
+  bugprone-*,
+  -clang-analyzer-optin.*,
+  -clang-analyzer-cplusplus.NewDeleteLeaks,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-narrowing-conversions,
+  -bugprone-branch-clone,
+  -bugprone-reserved-identifier,
+  -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-unhandled-self-assignment,
+  -bugprone-exception-escape
+
+# Engine headers are ours; third-party (Python.h, xerces) is excluded by the
+# regex so we only flag frePPLe code.
+HeaderFilterRegex: 'frepple/.*\.h$'
+WarningsAsErrors: ''
+FormatStyle: none

.dockerignore

@@ -0,0 +1,17 @@
+# Keep the E2E build context lean and host-artifact-free.
+.git
+venv
+build
+logs
+node_modules
+frontend/node_modules
+frontend/.next
+# Rust build dirs are host-arch artifacts; a leaked target/ shadows the
+# in-image cargo build (CMake sees the OUTPUT present and skips it), linking
+# a wrong-arch/index-less staticlib. Force a clean cargo build inside the image.
+**/target
+**/__pycache__
+*.pyc
+bin/frepple
+bin/libfrepple.*
+.DS_Store

.github/workflows/deploy-staging.yml

@@ -0,0 +1,77 @@
+name: Build staging images
+
+# Builds the modernization images on the ledoent x86 ARC runners and pushes them
+# to GHCR, where the Helm chart (deploy/helm/frepple) pulls them for the
+# frepple-staging review env on the hetzner-ledo cluster.
+#
+#   ghcr.io/ledoent/frepple-app:<sha>       (engine + Django; e2e/Dockerfile.engine)
+#   ghcr.io/ledoent/frepple-frontend:<sha>  (Next.js SPA;     e2e/Dockerfile.frontend)
+#
+# The runner is x86 (matching the cluster) and has a docker:dind sidecar, so a
+# plain `docker build` produces native amd64 images without buildx/QEMU emulation.
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - "modernization"
+    paths:
+      - "e2e/Dockerfile.engine"
+      - "e2e/Dockerfile.frontend"
+      - "e2e/entrypoint.sh"
+      - "src/**"
+      - "freppledb/**"
+      - "frontend/**"
+      - ".github/workflows/deploy-staging.yml"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io/ledoent
+
+jobs:
+  build:
+    name: Build & push ${{ matrix.image }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: frepple-app
+            dockerfile: e2e/Dockerfile.engine
+            # Phase 7: staging runs the Rust forecast methods (proven 5/5
+            # byte-parity in the forecast-phase7 gate). Default-OFF elsewhere.
+            rust: "ON"
+          - image: frepple-frontend
+            dockerfile: e2e/Dockerfile.frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # buildx + a GHCR registry cache: the engine's C++ build layer is restored
+      # from :buildcache, so a Python/frontend-only change skips the ~4-min
+      # recompile (the dind runner has no persistent local layer cache).
+      - name: Build & push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          build-args: |
+            FREPPLE_RUST_FORECAST=${{ matrix.rust || 'OFF' }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ matrix.image }}:${{ github.sha }}
+            ${{ env.REGISTRY }}/${{ matrix.image }}:latest
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:buildcache,mode=max

.github/workflows/engine-asan.yml

@@ -0,0 +1,83 @@
+name: Engine ASan
+
+# Debug build with AddressSanitizer over the C++ engine golden-test suite.
+# Catches memory errors (buffer overflows, use-after-free) that the Release CI
+# can't see. Deterministically flags the weight[] out-of-bounds read via the
+# test/forecast_11 long-history scenario.
+#
+# BLOCKING: the golden suite is ASan-clean (the 8 crashes rooted in the
+# Calendar::EventIterator operator-- UB are fixed). A new memory error now fails CI.
+#
+# Path-filtered so doc/CI/gate-only commits don't trigger the heavy build.
+
+on:
+  push:
+    branches:
+      - "modernization"
+      - "modernization/**"
+    paths:
+      - "src/**"
+      - "include/**"
+      - "test/**"
+      - "CMakeLists.txt"
+      - ".github/workflows/engine-asan.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-asan:
+    name: Debug + ASan engine tests
+    runs-on: ubuntu-24.04
+    # Blocking: the golden suite is ASan-clean (the 8 crashes from the
+    # Calendar::EventIterator UB are fixed). Future memory regressions fail CI.
+    steps:
+      - name: Checking out source code
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Nodes
+        uses: actions/setup-node@v6
+
+      - name: Install packages
+        run: |
+          sudo apt update
+          sudo apt install --no-upgrade libxerces-c-dev openssl libssl-dev libpq5 libpq-dev postgresql-client python3 python3-dev python3-venv python3-setuptools
+          sudo npm -g install pnpm@latest-10
+          pnpm install --frozen-lockfile
+
+      - name: Build (Debug + AddressSanitizer)
+        # CMAKE_BUILD_TYPE=Debug injects -fsanitize=address (CMakeLists.txt:88).
+        run: |
+          git submodule update --remote --checkout --force
+          grunt
+          cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=Debug
+          cmake --build ${{github.workspace}}/build --config Debug -- -j 4
+          . ${{github.workspace}}/venv/bin/activate
+          echo "PATH=$PATH" >> $GITHUB_ENV
+          echo "VIRTUAL_ENV=$VIRTUAL_ENV" >> $GITHUB_ENV
+
+      - name: Run engine golden tests under ASan
+        working-directory: ${{github.workspace}}
+        # detect_leaks=0: focus on memory-error detection (buffer overflows /
+        # use-after-free). The forecast_11 scenario forces the weight[] index
+        # above MAXBUCKETS, so a pre-fix binary aborts here with a
+        # global-buffer-overflow; post-fix it runs clean.
+        run: |
+          export FREPPLE_DATE_STYLE="day-month-year"
+          export ASAN_OPTIONS="detect_leaks=0:halt_on_error=1:abort_on_error=1"
+          # Exclude the stress scenario (test/stress_1): it solves ~24k operationplans,
+          # which under a Debug+ASan build is ~1000x slower (allocation-heavy at scale,
+          # ~24 min) than Release. It is a perf/scale gate, not a memory-safety one - it
+          # runs in the optimised ubuntu24 (Release) suite instead.
+          ./test/runtest.py -e stress_1
+
+      - name: Keep logs
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: asan_logs
+          path: logs
+          retention-days: 3

.github/workflows/engine-clang-tidy.yml

@@ -0,0 +1,99 @@
+name: Engine clang-tidy
+
+# Static-analysis baseline over the C++ engine (Engine track E1). The check set
+# (.clang-tidy) is the bug-finders only - clang-analyzer-* + high-signal
+# bugprone-* - not style. clang-tidy is parse-only (no codegen), so this is
+# lighter than the sanitizer Debug builds.
+#
+# ADVISORY: reports the finding count + breakdown in the job step-summary but
+# never fails the job (the baseline isn't zero on a large legacy codebase). It
+# tightens to "no NEW findings on changed files" (clang-tidy-diff) once the
+# baseline is triaged - tracked as E2. See tools/modernization/ubsan-baseline.md
+# for the sibling sanitizer gates.
+#
+# Path-filtered so doc/gate-only commits don't trigger it.
+
+on:
+  push:
+    branches:
+      - "modernization"
+      - "modernization/**"
+    paths:
+      - "src/**"
+      - "include/**"
+      - ".clang-tidy"
+      - ".github/workflows/engine-clang-tidy.yml"
+  pull_request:
+    paths:
+      - "src/**"
+      - "include/**"
+      - ".clang-tidy"
+      - ".github/workflows/engine-clang-tidy.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  clang-tidy:
+    name: clang-tidy (advisory)
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checking out source code
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install packages
+        run: |
+          sudo apt update
+          sudo apt install --no-upgrade libxerces-c-dev openssl libssl-dev libpq-dev python3 python3-dev python3-venv clang-tidy
+          clang-tidy --version
+
+      - name: Configure (export compile_commands.json)
+        # No build needed - clang-tidy parses TUs from the compile DB. Configure
+        # still generates config.h (referenced by the engine headers).
+        run: |
+          cmake -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
+
+      - name: Run clang-tidy over the engine (advisory)
+        # Parallel over the src/ TUs, each writing to its OWN log so concurrent
+        # writes can't interleave; then concatenate. Uses only `clang-tidy`
+        # (run-clang-tidy isn't always on PATH). Never fails the job - baseline
+        # capture only.
+        run: |
+          mkdir -p .tidy-logs
+          find src -name '*.cpp' -print0 \
+            | xargs -0 -P"$(nproc)" -I{} sh -c \
+                'clang-tidy -p build "$1" > ".tidy-logs/$(echo "$1" | tr "/." "__").log" 2>/dev/null || true' _ {}
+          cat .tidy-logs/*.log > clang-tidy.out 2>/dev/null || true
+          echo "clang-tidy run complete over $(find src -name '*.cpp' | wc -l) TUs"
+
+      - name: Summarise findings
+        if: always()
+        # A header finding is reported once per including TU; the warning line
+        # (path:line:col + check) is byte-identical across them, so `sort -u`
+        # collapses them to DISTINCT findings. The raw line count is shown too.
+        run: |
+          tidy='\[(clang-analyzer|bugprone)[a-zA-Z.-]+\]'
+          distinct=$(grep -hE ": warning: .*${tidy}" clang-tidy.out 2>/dev/null | sort -u | wc -l | tr -d ' ')
+          raw=$(grep -hcE ": warning: .*${tidy}" clang-tidy.out 2>/dev/null || echo 0)
+          {
+            echo "## clang-tidy baseline"
+            echo "distinct findings: **${distinct}**  (raw lines incl. header re-includes: ${raw})"
+            echo ''
+            echo 'By check (distinct):'
+            echo '```'
+            grep -hE ": warning: .*${tidy}" clang-tidy.out 2>/dev/null | sort -u \
+              | grep -oE "${tidy}" | sort | uniq -c | sort -rn \
+              || echo "(no findings)"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Keep report
+        uses: actions/upload-artifact@v6
+        if: always()
+        with:
+          name: clang-tidy-report
+          path: clang-tidy.out
+          retention-days: 7