feat: add the instrument hub and record provenance

[thomasbeaudry]

Adds an instrument view of collected data alongside the subject hub from #1654 (merged). Users can inspect one instrument edition across subjects, or open a series to see what its members collected.

• Browse sortable instrument listings with previews, minimum-record and collection-date filters, and listing downloads.
• Drill into instrument records with collection-method/series filters, sortable columns, and return links through series, instruments, and subjects. URL filters survive table/chart tab switches and apply to record downloads.
• Explore distributions and scatter plots; choose shared chart palettes on instrument and subject graphs, and download PNGs with headings and legends. Subject graphs also include non-form instruments.
• Show collection method and series in record tables. Record exports include instrument name/edition and provenance; wide series exports retain every member's measure columns.
• Add permission-scoped instrument/series summaries and series-record queries.

Merging main

#1654 merged, which conflicted this branch. 7b17710e4 merges main (432dec811). Four conflicts:

• instrument-records.service.ts — main deleted InitialMessage as unreachable while this branch renamed InitData to InitPayload/InitInstruments. Kept this branch's names without the deleted type; main's removal of the message.success check on the INIT acknowledgement merged cleanly.
• instrument-records.service.test.ts — took main's deletion of the test pinning a defect main has since fixed.
• subjects/$subjectId/graph.tsx — took this branch's renderChartPng rewrite whole. main's side was a cleanup inside the html2canvas block that rewrite replaces.
• datahub.visualization.selectMeasures — main removed it as dead once the subject graph stopped using it, but the instrument graph still reads it, so it is restored in 5657bbc84.

This branch forked before two gates main has since added, so it had never been measured against either:

• The unit test layout rule (odc/unit-test-names-subject). Three flat specs under apps/web/src/__tests__/ moved beside the files they test.
• 100% unit coverage (pnpm test:coverage). 21 files were short, seven of them at 0%: both chart components, SelectChartPalette, and four instrument hub route files.

Defects the coverage gate exposed

Three branches turned out to be unreachable because the code around them was wrong:

• The scatter tooltip rendered the collection date as a raw epoch. formatter compared the row name against 'time', but recharts passes the axis name, so the comparison never held and both rows fell through to the measure label. The labelFormatter that did the date formatting is never called for a ScatterChart at all. The date is now formatted in the row recharts actually names after the x axis.
• instrument-hub.spec.ts expected an em-dash in the series cell. f6d3f8295 changed that cell to a translated "None" without updating the spec, which could not run while the branch conflicted.
• subject-detail.spec.ts waited on the glob **/graph. The subject tab links now carry the chart palette, so clicking one lands directly on …/graph?palette=default and the URL never passes through a query-free state — a ** glob cannot match it, and the test timed out while sitting on the correct tab. The wait is now a regex allowing the query string.

Code removed rather than covered

Each of these is unreachable, so it is deleted rather than pinned by a test:

• The isSeries branch of measureColumns in instruments/$instrumentId/table.tsx, which built an INSTRUMENT column for a DataTable that function's own early return means is never rendered.
• The InstrumentTable toolbar's ?./?? fallbacks for the three columns it declares itself and seeds filters for in initialState.
• getCategoricalColor's neutral fallback (the index is always below MAX_CATEGORICAL_GROUPS, and every theme holds six hues), binDistribution's second ?? 0 (that row is pre-seeded at zero for every series key), and the export mapping's ?? 'N/A' for a username the records mapping has already defaulted.
• html2canvas, which renderChartPng replaced, together with its lockfile entries.
• RecordChartPoint and DistributionRow, exported but used only in their own file.

Validation on e6d8421f8

• pnpm lint — 34/34, and green again on an immediate second pass. The second pass matters: each workspace's lint is tsc && eslint --fix src, so tsc runs before the fixer and a single green pass says nothing about the file left on disk.
• pnpm test:coverage — 4,649 passed and 4 expected failures; 100% statements, branches, functions and lines.
• pnpm knip — clean, apart from the pre-existing turbo in ignoreBinaries hint.
• pnpm test:e2e — 285/286 locally. The one failure is record-file-deletion.spec.ts, which 503s on record creation because a bare local stack starts no S3/rustfs backend. It passes in CI.
• CI on e6d8421f8: every check green, including the lint-and-test job that runs lint, the coverage gate and the full Playwright suite.

Validation notes

• An earlier local e2e run reported seven failures across unrelated specs and eleven tests that did not run. All 43 of those tests pass with --workers=1; it was contention on the shared database under six local workers, not a regression.
• apps/web/src/route-tree.ts was checked against the routes on disk and is in sync — every instrument hub route is registered. The generator was not run, per the repository rule that the user regenerates it.
• The replacement chart hues still have no renewed colourblind-separation validation.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Co-Authored-By: GPT-6

🤖 Generated with Claude Code

[gdevenyi]

This branch has merge conflicts with main, so review is on hold.

Please merge or rebase on the current main, resolve the conflicts, run pnpm lint and pnpm test:coverage locally, and push. Review continues when the branch merges cleanly and CI is green.

Reviewed at commit f6d3f82.