feat: instrument DORA delivery metrics + dashboard tab

[bdevierno1]

Summary

• GET /api/dora — new FastAPI endpoint that reads git log main over a configurable rolling window (default 30 d) and computes all four DORA metrics from raw commit history, with no external dependencies.
• DoraDashboard.tsx — React component with health-coloured KPI cards (green/yellow/red vs targets), a 7/30/90-day window selector, and a refresh button; mounted behind a new DORA Metrics tab in the app header.
• App.tsx — adds an Operations | DORA Metrics tab bar; existing ops view is fully unchanged.

Metric definitions (from dora-metrics-and-targets.md)

Metric	Source	Target
Deployment Frequency	Non-trivial commits/day to main (excludes docs/style/test/chore/ci/build prefixes)	≥ 1 / day
Lead Time for Changes	Median author→committer date delta in hours	< 24 h
Change Failure Rate	fix|revert|hotfix commits / total commits	< 15 %
Recovery Time	Median inter-fix-commit interval in hours	< 1 h

Anti-patterns avoided

• Trivial config-only commits excluded from deploy count via conventional-commit prefix filter
• Lead time measured from commit author date (first commit), not ticket creation

Test plan

# Backend: verify import and computation
cd backend && .venv/bin/python -c "
from app.routers.dora import _git_log, _compute, _repo_root
from datetime import datetime, timezone, timedelta
repo = _repo_root()
since = (datetime.now(timezone.utc) - timedelta(days=365)).isoformat()
entries = _git_log(repo, since)
m = _compute(entries, 365)
assert m.commit_count > 0
print('PASS', m.deploy_count, 'deploys', m.lead_time_hours, 'h lead time')
"

# HTTP smoke test (requires running backend)
curl -s http://localhost:8000/api/dora | python3 -m json.tool

# Frontend: start dev server, click DORA Metrics tab, verify 4 KPI cards render
cd frontend && npm run dev

Out of scope (follow-up)

• Per-service breakdown (single-repo today)
• GitHub PR API for precise lead time (branch → PR merge, not author→committer)
• CI/CD event ingestion (no Actions yet; git history is the source of truth)
• Prometheus exposition of DORA metrics (can extend /api/metrics)

---

🤖 Generated with Vecna

Co-Authored-By: Vecna noreply@vecna.ai

[bdevierno1]

Backend coverage gate remediated.

The Backend — tests & coverage job was failing on --cov-fail-under=60 (total 52–59%), not on any test failure — the new DORA router (backend/app/routers/dora.py) shipped untested at 37% line coverage.

Added tests (pushed directly to dora-metrics-dashboard):

• tests/test_dora.py — dora.py 37% → 95%: metric computation branches (_compute), _git_log against a throwaway repo, _repo_root, and the GET /api/dora endpoint + query validation.
• tests/test_backend_units.py, tests/test_serialize.py, tests/test_url_guard.py — deterministic, platform-independent coverage of the operation telemetry/serialization/SSRF-guard surface (the CI runner on Python 3.11 covers a few startup-path lines differently than local 3.14, so extra margin was needed).

Total backend coverage: 54% → ~68%. Backend — tests & coverage and CI gate (required) are now green.

Two notes for the operator:

• PR size gate (< 400 lines) remains red (this PR is +714/−26). Splitting the feature is a discretionary product decision and was intentionally left untouched. It does not gate CI gate (required), which only requires the backend + frontend jobs.
• Re-requesting larstalian as reviewer is not possible via API: GitHub returns 422 — Reviews may only be requested from collaborators (larstalian is not a collaborator on this repository). Please add them as a collaborator or request the review manually.