refactor(api): extract web app runtime bootstrap

[hjlarry]

Summary

• add a stable Web App Runtime query capability for the public Web app bootstrap
• move App, Tenant, and Site reads into a repository-owned session and complete scalar mapping before external feature or storage work
• centralize Web app icon URL selection in FileService and keep the controller limited to admission, error mapping, and dump_response serialization

Why

The Web /site controller currently performs ORM reads and then calls feature and file infrastructure from the request path. This change gives those responsibilities explicit owners while reusing the existing App Definition database adapter instead of adding an endpoint-specific repository.

Compatibility

• preserves the existing WebAppSiteResponse schema and generic 403 behavior for unavailable sites
• preserves Cloud plus S3 direct icon URLs and preview URLs in other deployments
• leaves the Human Input site projection on its existing behavior
• keeps legacy Agent-compatible mode resolution

Stack: follows #40795.

[github-actions]

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-08-20 04:31:41.439133234 +0000
+++ /tmp/pyrefly_pr.txt	2026-08-20 04:31:26.880976095 +0000
@@ -630,8 +630,6 @@
   --> tests/integration_tests/workflow/test_response_stream_filter_integration.py:75:37
 ERROR Argument `core.workflow.nodes.human_input.entities.HumanInputNodeData` is not assignable to parameter `data` with type `graphon.nodes.human_input.entities.HumanInputNodeData` in function `graphon.nodes.human_input.human_input_node.HumanInputNode.__init__` [bad-argument-type]
    --> tests/integration_tests/workflow/test_response_stream_filter_pause_resume_integration.py:113:14
-ERROR Argument `Literal['image']` is not assignable to parameter `value` with type `IconType | SQLCoreOperations[IconType | None] | None` in function `sqlalchemy.orm.base.Mapped.__set__` [bad-argument-type]
-   --> tests/test_containers_integration_tests/controllers/web/test_site.py:116:26
 ERROR Argument `SimpleNamespace` is not assignable to parameter `webapp_settings` with type `WebAppSettings | None` in function `controllers.web.wraps._validate_user_accessibility` [bad-argument-type]
   --> tests/test_containers_integration_tests/controllers/web/test_wraps.py:78:33
 ERROR Argument `SimpleNamespace` is not assignable to parameter `webapp_settings` with type `WebAppSettings | None` in function `controllers.web.wraps._validate_user_accessibility` [bad-argument-type]
@@ -3771,7 +3769,7 @@
 ERROR Returned type `AppDatabase` is not assignable to declared return type `Iterator[AppDatabase]` [bad-return]
    --> tests/unit_tests/controllers/service_api/app/test_app.py:154:12
 ERROR Object of class `FromClause` has no attribute `delete` [missing-attribute]
-   --> tests/unit_tests/controllers/service_api/app/test_app.py:366:29
+   --> tests/unit_tests/controllers/service_api/app/test_app.py:367:29
 ERROR Cannot index into `Iterable[bytes]` [bad-index]
    --> tests/unit_tests/controllers/service_api/app/test_audio.py:191:16
 ERROR Cannot index into `Response` [bad-index]
@@ -8715,7 +8713,7 @@
 ERROR `not in` is not supported between `None` and `str` [unsupported-operation]
    --> tests/unit_tests/services/test_feedback_service.py:166:16
 ERROR Argument `Literal['invalid']` is not assignable to parameter `session_factory` with type `Engine | sessionmaker[Unknown] | None` in function `services.file_service.FileService.__init__` [bad-argument-type]
-  --> tests/unit_tests/services/test_file_service.py:75:41
+  --> tests/unit_tests/services/test_file_service.py:76:41
 ERROR Unexpected keyword argument `whole_workspace` in function `core.workflow.human_input_adapter.EmailRecipients.__init__` [unexpected-keyword]
    --> tests/unit_tests/services/test_human_input_delivery_test_service.py:250:44
 ERROR Argument `list[FromClause]` is not assignable to parameter `tables` with type `Sequence[Table] | None` in function `sqlalchemy.sql.schema.MetaData.create_all` [bad-argument-type]

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	59.75%	59.76%	+0.01%
Strict coverage	59.33%	59.34%	+0.01%
Typed symbols	39,817	39,840	+23
Untyped symbols	27,011	27,013	+2
Modules	3176	3178	+2

[codecov]

Codecov Report

❌ Patch coverage is 97.93814% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.82%. Comparing base (5550ec8) to head (6eb329f).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...pi/repositories/app_definition_query_repository.py	92.59%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #40949   +/-   ##
=======================================
  Coverage   86.81%   86.82%           
=======================================
  Files        5198     5199    +1     
  Lines      291566   291642   +76     
  Branches    58089    58093    +4     
=======================================
+ Hits       253130   253210   +80     
+ Misses      33449    33444    -5     
- Partials     4987     4988    +1     

Flag	Coverage Δ
api	86.85% <97.93%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.