feat(orb): registration-gate the fleet + cap ingest body (das-github-mirror model)

[JSONbored]

Summary

Answers "how should /v1/orb/ingest be protected?" by following das-github-mirror's ingress model instead of #1248's shared ORB_INGEST_SECRET — which would break #1257's hardwired-on, no-shared-key telemetry (every self-hoster would 401 without the secret). das-github-mirror keeps ingress open + verified-by-context and gates trust on a registered=false-by-default flag + dedup + a body limit. Orb's many-instances→one-collector topology has no per-instance key the collector could verify, so the faithful translation is:

• Open ingest, bounded. readOrbIngestBody reads behind a 1 MiB ceiling (streaming, with a content-length fast-path) → 413 on oversize. Mirrors the body limit das-github-mirror puts in front of its open webhook ingress. Dedup already exists via UNIQUE(instance_id, repo_hash, pr_hash).
• Registration gate (the trust anchor). New orb_instances table — every instance that ingests is recorded (registered=0 by default, like das-github-mirror's registered flag). Signals are still stored for everyone (so registration is retroactive), but computeFleetAnalytics counts only registered instances toward the fleet median. A stranger — or a coordinated ring — can't move calibration until an operator opts them in (directly fixes the "median gameable by a bad-actor ring" risk from Fleet-derived gate auto-tune: design + data-readiness gate (do not build yet) #1272).
• Operator endpoints (internal-token gated): GET /v1/internal/orb/instances lists pending + registered instances with their stored-signal counts; POST /v1/internal/orb/instances/register opts one in ({instanceId, registered?}, defaults true).

Supersedes #1248 (keeps its DoS hardening, drops the shared-secret requirement).

Behavioral note

The fleet surfaces shipped in #1268 (operator dashboard fleetMetrics + the gittensory_get_fleet_analytics MCP tool) now read empty until the operator registers at least one instance — the intended trust posture. Register the home instance once and it flows. (The #1270 end-to-end test will get a one-line register once both land — noted there.)

Scope

• 8 files; migration 0061_orb_instances.sql is the next contiguous number
• Portable ON CONFLICT … DO UPDATE upserts (no pg-dialect change needed); internal routes (not in OpenAPI)
• No secrets/wallets/trust-scores; no new env var

Validation

• npm run test:ci — green (incl. db:migrations:check, typecheck, coverage, workers, ui)
• 100% branch coverage on every changed src/** line (ingest.ts, analytics.ts, routes.ts) — verified against the v8 JSON report, incl. both ?? [] guards, the json().catch, the body-cap content-length vs streaming paths, and registered/unregistered fold
• Updated the feat(orb): surface fleet calibration analytics via dashboard + MCP #1268 fleet tests (operator-dashboard, mcp-fleet-analytics) + orb-analytics to register instances; added an explicit "unregistered stranger excluded" test

Safety

• Ingest stays frictionless (no shared secret) but cannot skew calibration without operator opt-in
• Best-effort instance bookkeeping never fails an ingest; analytics fail-safes to an empty report on DB error

Advances #1255.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.05%. Comparing base (480f2c3) to head (6b4d25c).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1274   +/-   ##
=======================================
  Coverage   95.04%   95.05%           
=======================================
  Files         177      177           
  Lines       19944    19981   +37     
  Branches     7179     7189   +10     
=======================================
+ Hits        18956    18993   +37     
  Misses        395      395           
  Partials      593      593           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.44% <100.00%> (+0.03%)	⬆️
src/orb/analytics.ts	100.00% <100.00%> (ø)
src/orb/ingest.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.