feat(orb): add POST /v1/orb/ingest central collector endpoint

[JSONbored]

Summary

• Adds POST /v1/orb/ingest to the main Cloudflare Worker — the central collector endpoint for anonymized outcome signal batches sent by self-hosted Orb instances via exportOrbBatch
• New orb_signals table (migration 0058) with UNIQUE(instance_id, pr_hash) dedup; no raw repo names or PR content stored — only HMAC-anonymized hashes + aggregate outcome metadata
• Route excluded from requiresApiToken (unauthenticated by design; sender already HMAC-anonymizes data before export)
• Batch size capped at 500 events per request; malformed events skipped without throwing; DB errors swallowed best-effort

Scope

• New files only (migrations/0058_orb_signals.sql, src/orb/ingest.ts, test/integration/orb-ingest.test.ts)
• Minimal change to src/api/routes.ts (import, route registration, one requiresApiToken exemption)
• No changes to existing routes, auth logic, or other modules
• Stays inside wantedPaths; no blockedPaths touched

Validation

• npm run test:ci — fully green (exit 0)
• npm run db:migrations:check — 60 migrations, contiguous 0001..0058, no duplicates
• npm run typecheck — clean
• src/orb/ingest.ts — 100% statements / 100% branches / 100% functions (24 tests covering every ?? / ternary / && branch, both sides of each)
• Rebased on post-merge main (after feat(selfhost): add Gittensory Orb outcome signal collector (#1219) #1224 added 0056_orb_events + 0057_orb_installations)

Safety

• No auth/CORS/session changes
• No secrets, wallets, hotkeys, trust scores, or reward values anywhere
• No negative-path auth tests needed — route is intentionally unauthenticated (data is pre-anonymized by sender)
• Dedup enforced at DB layer via INSERT OR IGNORE on UNIQUE(instance_id, pr_hash)

Advances #1219

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (f98333d) to head (1706ed5).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1234   +/-   ##
=======================================
  Coverage   94.95%   94.96%           
=======================================
  Files         176      177    +1     
  Lines       19740    19772   +32     
  Branches     7098     7110   +12     
=======================================
+ Hits        18744    18776   +32     
  Misses        397      397           
  Partials      599      599           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.39% <100.00%> (+0.02%)	⬆️
src/openapi/spec.ts	99.39% <100.00%> (+<0.01%)	⬆️
src/orb/ingest.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	058dfff	Commit Preview URL Branch Preview URL	Jun 24 2026, 12:00 PM