fix(control-center): restore GET /report/data to public

[man4ish]

Summary

Reverses part of commit 8705cbf (control.omnibioai.org direct-tunnel route audit): restores GET /report/data to fully public, no auth required.

Last night's follow-up (5fe7c6a, 2026-09-02) restored /report/status and /llms after confirming 8705cbf over-gated them, but deliberately left /report/data gated — its projects[]/languages[]/coverage[]/gitStatus[] arrays name every repo and expose live dev state, so /report/public-stats (a narrow, aggregate-only, repo-name-free endpoint) was built alongside that fix as the intended public replacement.

Tonight's investigation into control.omnibioai.org's "Projects" tab showing "No report data yet" (after yesterday's separate Cloudflare tunnel routing fix) found that /report/public-stats was never actually wired into the frontend — PublicEcosystemPage.tsx's four tabs (Projects, Languages, Code Coverage, Ecosystem Status) all share a single GET /report/data call, which has 401'd for anonymous visitors since 8705cbf. Every tab was silently broken.

This is a deliberate reversal, not a bug fix for an oversight

We are consciously accepting that gitStatus[] (branch names, modified/untracked/unpushed commit counts across every repo) becomes publicly visible, in exchange for restoring the full public Ecosystem Report dashboard. This was an explicit, confirmed decision this time — unlike 8705cbf's original over-gate, which was accidental.

/report/public-stats is left in place unchanged — still the minimal, repo-name-free option for anyone who only wants aggregate totals.

Changes

• main.py: drop Depends(require_permission("platform.manage_infra")) from report_data(); update its docstring and the adjacent /report/status + /report/public-stats section comments, which asserted /report/data would stay admin-only.
• Confirmed /report/data is its own @app.get, not on a shared router (unlike /report/status//llms, which were both bare @app.get too) — no router-level gate to split.
• test_main.py:
  • TestReportData now asserts 200 (not 401) with no token, plus a test_200_with_token_too for parity with TestLlmsPublicAccess.
  • Removed /report/data from TestPlatformManageInfraAuth's still-gated case list and TestOverGateRegressionGuard.STILL_GATED — same pattern as /report/status//llms last night.
  • test_public_dashboard_no_leak.py untouched — /report/public-stats's forbidden-key sweep still applies to that endpoint only.

Testing

• Full suite: 1717 passed, 98.47% coverage (98% required), main.py at 100%.
• Targeted re-run of TestReportData, TestPlatformManageInfraAuth, TestOverGateRegressionGuard, TestReportStatus, TestLlmsPublicAccess: all pass.
• test_public_dashboard_no_leak.py: 11/11 pass, unmodified.
• Manual verification against the modified source with the real generated report_data.json (no Authorization header): 200 with projects (32), languages (25), coverage (32), gitStatus (33) all populated. The currently-running container still 401s until this merges and redeploys — expected, not a discrepancy.

Not merging — opening for review per the explicit ask.

🤖 Generated with Claude Code