feat(frontend): add non-visual architecture graph list view (#239)

[parthrohit22]

Summary

Adds a "List View" tab to the Architecture workspace that renders the same sealed-snapshot model (useArchitectureStore().model) already driving the React Flow canvas as three semantic HTML tables — modules, relationships, and diagnostics — so a screen-reader or keyboard-only user can review the complete architecture graph without traversing the visual canvas node by node.

Linked issue

Part of #239

Roadmap alignment

This does not map cleanly onto a single §23 (W0–W8) lane — accessibility/WCAG work isn't named as its own workstream in the roadmap. Flagging this honestly rather than forcing a citation. Context for the maintainer: this is a direct continuation of the accessibility/trust-gap baseline you already claimed and merged (#118 → PR #241, test(a11y): establish WCAG 2.2 AA baseline), where #239 is explicitly filed as "the dedicated non-visual-equivalent follow-up required by #118; it is intentionally not implemented in the baseline PR." Treating that as the accepted evidence this PR advances, since it closes a defect you already tracked to completion via #118's manual-evidence log, rather than a new roadmap workstream.

• Roadmap §23 workstream this advances: none directly named; continuation of the chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118 accessibility baseline
• §28 market-fit criterion this moves toward: not directly applicable — see note above
• Accepted evidence it is real: chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118's 2026-08-03 manual-evidence comment, which names a11y: provide a complete non-visual architecture graph contract #239 as the specific outstanding gap ("there is still no complete ordered non-visual inventory of all nodes, relationships, trust state, and unresolved diagnostics")

What changed

• apps/frontend/src/features/architecture/store.ts — extended activeTab to include 'list'.
• apps/frontend/src/features/architecture/components/ArchWorkspace.tsx — added a fourth "List View" tab button (same pattern as the existing Graph/Request Flow/Heatmap buttons) and renders ArchitectureListView when selected.
• apps/frontend/src/features/architecture/components/ArchitectureListView.tsx (new) — reads model directly from useArchitectureStore (no second fetch): a Modules table (name/type/layer/relationship state, ordered by layer then name), a Relationships table (source/target/type/predicate/truth state, ordered by source then target name), and a Diagnostics table (severity/code/message/location/related modules, ordered by severity then code). Each module and relationship endpoint is a real <button> that calls setSelectedNodeId, the same store action the canvas and NodeInspector already use, so selecting a row highlights the row and keeps table/canvas/inspector selection in sync.
• apps/frontend/src/features/architecture/components/ArchitectureListView.test.tsx (new) — 5 tests covering ordering, selection sync from both the modules and relationships tables, diagnostic rendering with a working related-module link, and explicit empty states.
• apps/frontend/package.json / package-lock.json — out-of-scope but necessary: cherry-picked the fix from security(deps): bump dompurify, js-yaml, brace-expansion, undici #257 (security/256-dependency-audit-overrides) to unblock this PR's own CI. Four npm advisories published after dev's last CI run made the Frontend job's dependency-audit gate fail on every open PR, unrelated to this PR's own diff. security(deps): bump dompurify, js-yaml, brace-expansion, undici #257 is the canonical fix targeting dev directly; this is the identical commit cherry-picked so this PR isn't stuck waiting on that one to merge and be rebased. See security(deps): bump dompurify, js-yaml, brace-expansion, undici #257 for full detail on the four advisories/patched versions.

Acceptance criteria completed

• Expose node name/type/layer/trust state
• Expose relationship source/target/predicate/state (plus edge type)
• Include unresolved diagnostics (full model.diagnostics, not just the selected node's subset RelationshipPanel already showed)
• Support keyboard navigation — native <table> with real <button> cells, fully reachable via Tab in document order
• Keep the visual graph and non-visual representation synchronized — shared selectedNodeId in useArchitectureStore
• Add component and seeded browser coverage — component coverage added; seeded Playwright/e2e coverage was not added (see Scope changes below)

Testing performed

node scripts/dependency-audit.mjs
  -> No blocking findings (1 accepted: pre-existing, unrelated react-router acceptance)

npm --prefix apps/frontend run test -- --run
  Test Files  39 passed (39)
  Tests       220 passed (220)

npm run lint:frontend
  eslint . -> clean, no errors

npm run build:frontend
  tsc -b && vite build -> succeeded

Not run: npm run test:prototype (Playwright) and a live browser/screen-reader check — no browser automation tool is available in this session. Verified via component tests only, which render the real DOM output and assert on structure, ordering, and click-driven selection sync.

Screenshots

Not applicable — no browser automation available in this session to capture one; see Testing performed for the honest limitation.

Security and data considerations

The List View feature itself: none. Purely a client-side rendering of data already fetched by the existing owner-scoped /analysis/{id}/architecture call and already displayed by the canvas/inspector; no new API calls, no new endpoints, no new data exposure.

The cherry-picked dependency bump: closes four npm advisories (one runtime-reachable, three dev/build-time-only) — see #257 for detail.

Dependencies and blocked work

None functionally, but note: this PR's package.json/package-lock.json diff duplicates #257's commit. Once #257 merges to dev and this branch is rebased, that duplication resolves to a no-op (identical content) rather than a conflict.

Scope changes or remaining work

• Did not add seeded Playwright/e2e coverage for the new List View tab (e.g. extending e2e/architecture-visual.spec.ts or e2e/accessibility.spec.ts) — no browser automation tool was available in this session to author or verify a new spec. Flagging as necessary follow-up before this fully satisfies a11y: provide a complete non-visual architecture graph contract #239's acceptance criteria; using "Part of a11y: provide a complete non-visual architecture graph contract #239" rather than "Closes a11y: provide a complete non-visual architecture graph contract #239" for this reason.
• The new tab button reuses the existing plain-button tab pattern already used by Graph/Request Flow/Heatmap (not full ARIA tablist/tab/tabpanel semantics with aria-selected/roving tabindex). Upgrading all four tabs to proper ARIA tab semantics would be a broader change touching existing tabs beyond this issue's proposed scope, so it was left as-is for consistency with the current UI rather than folded in here.
• No manual screen-reader (VoiceOver) or 200%-zoom pass was performed, consistent with chore: establish a WCAG 2.2 AA accessibility baseline for the product UI #118's own disclosed "not tested" status for those checks in this environment.
• Cherry-picked security(deps): bump dompurify, js-yaml, brace-expansion, undici #257's dependency bump into this branch to unblock CI (see "What changed" above) — this is scope-creep relative to a11y: provide a complete non-visual architecture graph contract #239 itself, done deliberately and disclosed rather than silently included, because the alternative was leaving this PR red for a cause entirely outside its own diff.

Contributor checklist

• This PR targets dev
• I claimed the issue and had it assigned before starting substantial work (self-assigned a11y: provide a complete non-visual architecture graph contract #239; not commented per maintainer instruction)
• The branch was created from an up-to-date upstream/dev
• The branch is rebased on the latest upstream/dev
• This PR addresses one clearly scoped issue — with one disclosed exception (cherry-picked CI-unblocking commit, see above)
• This PR advances a §23 workstream toward a §28 market-fit criterion — see honest Roadmap alignment note above
• Every acceptance criterion I claim as complete is actually complete
• Relevant tests pass
• Documentation is updated for any user-visible change — no separate public doc describes tab-by-tab Architecture UI behavior to update
• No secrets, credentials, local env files, or generated artifacts are included
• No unrelated files were changed — see disclosed exception above (package.json/package-lock.json, cherry-picked from security(deps): bump dompurify, js-yaml, brace-expansion, undici #257)
• Closing syntax (Closes) is used only because the issue is fully resolved — not used here, "Part of" instead
• Dependencies and follow-up work are linked