feat(api): integrate identity, notification scope and connection settings into control plane

- Wire identity, metrics and update services into the assembled API.

- Add connection authorization modes and scoped console authorization.

- Preserve notification group IDs for filtered delivery.

- Extend maintenance, backup, resource and module flows with runtime metadata and upstream safety.

apps/api/src/infrastructure/transport/safe-upstream-gateway.test.ts

@@ -65,6 +65,22 @@ describe('SafeUpstreamGateway', () => {
       },
     ]);
   });
+  it('allows the pinned aggregate network-speed read', async () => {
+    const get = vi.fn(async () => ({ status: 200, headers: {}, body: '{"data":{}}' }));
+    const gateway = new SafeUpstreamGateway({
+      transport: { get, post: async () => ({ status: 204, headers: {}, body: '' }) },
+    });
+    await expect(
+      gateway.request({
+        url: 'http://192.168.1.20:8080/api/network/speed',
+        method: 'GET',
+        headers: { accept: 'application/json' },
+      }),
+    ).resolves.toMatchObject({ status: 200 });
+    expect(get).toHaveBeenCalledWith('http://192.168.1.20:8080/api/network/speed', {
+      accept: 'application/json',
+    });
+  });
   it('rejects HTTP login and logout so credentials and cookies are never sent in cleartext', async () => {
     const gateway = new SafeUpstreamGateway({
       transport: {

apps/api/src/infrastructure/transport/safe-upstream-gateway.ts

@@ -70,6 +70,7 @@ const DEVICE_READ_PATHS: Readonly<Record<string, RegExp>> = {
   '/api/voicemail/status': /^$/u,
   '/api/ims/status': /^$/u,
   '/api/network/operators': /^$/u,
+  '/api/network/speed': /^$/u,
   '/api/network/signal-strength': /^$/u,
   '/api/network/interfaces': /^$/u,
   '/api/network/connection-addresses': /^$/u,