feat(api): absorb the Hub control plane into the local instance model

Add central notification channels, rules, queue and delivery logs, fleet
organization groups and tags, device discovery, the device action catalog,
instance module reads, the log centre, connection settings and system
maintenance as native /api/v1 routes backed by the existing secret store,
audit trail and pinned upstream transport.

apps/api/src/application/operations/secure-operation-execution.ts

@@ -37,6 +37,15 @@ const EXECUTABLE_OPERATIONS: Readonly<Record<string, SecureOperationDescriptor>>
     requestContentType: 'none',
     parameterSchemaId: 'simadmin.58e2204.postServiceRestart.parameters.v1',
   }),
+  postBasebandRestart: Object.freeze({
+    operationId: 'postBasebandRestart',
+    title: 'Restart Baseband',
+    riskLevel: 'R3',
+    method: 'POST',
+    pathTemplate: '/api/baseband/restart',
+    requestContentType: 'none',
+    parameterSchemaId: 'simadmin.58e2204.postBasebandRestart.parameters.v1',
+  }),
   postSystemReboot: Object.freeze({
     operationId: 'postSystemReboot',
     title: 'Reboot System',
@@ -56,7 +65,11 @@ export const secureOperationRegistry: SecureOperationRegistry = {
   },
 };
 
-const ZERO_BODY_OPERATIONS = new Set(['postNetworkRegisterAuto', 'postServiceRestart']);
+const ZERO_BODY_OPERATIONS = new Set([
+  'postNetworkRegisterAuto',
+  'postServiceRestart',
+  'postBasebandRestart',
+]);
 const SYSTEM_REBOOT_OPERATION = 'postSystemReboot';
 const SYSTEM_REBOOT_DELAY_SECONDS = 3;
 const ACTOR = 'loopback-control-plane';
@@ -437,7 +450,7 @@ export class SecureOperationExecution {
     return this.options.db.transaction(() => {
       const jobs = this.options.db
         .prepare(
-          "SELECT id FROM jobs WHERE operation_id IN ('postNetworkRegisterAuto','postServiceRestart','postSystemReboot') AND risk_level IN ('R2','R3') AND status='running'",
+          "SELECT id FROM jobs WHERE operation_id IN ('postNetworkRegisterAuto','postServiceRestart','postBasebandRestart','postSystemReboot') AND risk_level IN ('R2','R3') AND status='running'",
         )
         .all() as Array<{ id: string }>;
       for (const row of jobs) this.finishByJob(row.id, now, 'unknown-result', 'INTERRUPTED');