[cjimti]

Adds two portal settings, portal.login_redirect and portal.allow_api_key_login. Also changes the make verify lane order, moves the dev stack's TLS object store to SeaweedFS 4.48, and adds two interval environment variables, MCP_PLATFORM_CONNECTION_ALERT_INTERVAL and MCP_PLATFORM_SCRIPT_SCHEDULER_INTERVAL. It also updates 14 acceptance files. The fixes cover 3 bugs:

1. The E2E Nightly could not start the dev stack because the object-store image it used could not be pulled (E2E Nightly is failing #2245).
2. On a dev stack moved to other ports, browser sign-in failed because Keycloak did not accept the moved callback address.
3. Storage page on a fresh install: a first-boot burst is projected as daily growth, a flat store shows a negative slope, and sub-byte rates render as "undefined" #2201's acceptance criteria still expected the retention rules from before Storage forecast on a fresh install: a first-boot burst becomes a fill date and can raise exhaustion alerts; both replicas sample every tick #2203.

Closes #2242
Closes #2243
Closes #2245
Refs #2232
Refs #2233

Sign-in straight to the identity provider (#2242)

Two new portal: settings:

Key	Default	Effect
login_redirect	false	When OIDC browser sign-in is on, opening the portal's sign-in page sends the browser straight to the identity provider.
allow_api_key_login	true	false hides the API key form on the sign-in page.

• login_redirect needs both auth.oidc.enabled and auth.browser_session.enabled. Without them it is ignored, and startup logs the login_redirect_ignored configuration warning, counted in config_validation_warnings_total{code}. The rule lives in internal/platform/portalcfg (LoginRedirect, APIKeyLoginAllowed).
• The public branding route reports both values as login_redirect and allow_api_key_login, already resolved (pkg/admin/system.go). A deployment without OIDC never reports login_redirect: true.
• LoginForm behavior:
  • With login_redirect on, it shows a loading indicator and replaces the page with the identity provider's sign-in.
  • ?login=api_key still shows the key form, so an administrator can always use a key.
  • When the URL carries a sign-in error, the page does not redirect again; it shows the error and a "Try again" button. This prevents a redirect loop when the identity provider refuses the user.
• ImplementorConfig and PortalRateLimitConfig are now type aliases over portalcfg.Implementor and portalcfg.RateLimit, so existing references compile unchanged. They moved because pkg/platform was at its package size budget.
• Documented in docs/server/configuration.md ("Sending sign-in straight to the identity provider"), README.md, docs/llms.txt and docs/llms-full.txt.

Readers of this state

The two new branding fields are read by:

• ui/src/api/portal/hooks/assets.ts: the Branding type.
• ui/src/components/LoginForm.tsx: the redirect and the key form.
• ui/src/mocks/handlers.ts: the MSW branding response.

No other reader of the branding route uses these fields.

verify's UI lane runs after the static lane (#2243)

make verify now runs verify-static-ui, which runs verify-static and then verify-ui, beside verify-go and verify-docker. Running the UI lane alongside every other lane pushed the load past vitest's 5-second per-test timeout. TestVerifyStartsTheUILaneAfterTheStaticLane (test/gates/verify_order_test.go) pins the order.

Dev stack: SeaweedFS over TLS for managed resources (#2245)

• dev/docker-compose.yml replaces the store service for managed resources with seaweedfs-resources. It runs chrislusf/seaweedfs:4.48, pinned by digest, and serves S3 over TLS on 8443 (DEV_S3_TLS_PORT, default 9443). 3.88 is not used because it drops HTTP/2 requests over TLS, and the platform's S3 client sends HTTP/2.
• dev/start.sh writes the certificate to dev/.tls/seaweedfs with the SAN seaweedfs-resources, waits for the store, and creates the buckets. Trino trusts the certificate through the keystore import, and scratch_resources.properties points at https://seaweedfs-resources:8443.
• When the stack is moved to other ports (DEV_OFFSET other than 0), dev/start.sh adds the portal's moved address to the Keycloak portal client's redirect URIs, web origins and post-logout redirect URIs through the Keycloak admin API.
• The acceptance criteria that read or describe this store (A registration whose table no longer exists is still listed as registered, so a follow that lost a neighbouring table reports success and the listing hides it #1546, The managed-resource blob write is the one upload path without multipart, so a large upload fails against a backend that bounds a single PUT #1631, Resources: bulk upload, one action for many files #1862, feat(webhooks): inbound webhook sources landing events as Parquet #1870, feat(portal): self-hosted street maps for HTML assets #2068, webhooks: durable local spool (write-ahead log) so acknowledgement doesn't depend on object-storage latency #2121) now use the new service name and certificate path.

Fewer real-clock waits in the acceptance suite (#2232)

New environment variables:

Variable	Sets	Dev stack value
MCP_PLATFORM_CONNECTION_ALERT_INTERVAL	connection alert pass interval (internal/httpserver/alertwire)	2s
MCP_PLATFORM_SCRIPT_SCHEDULER_INTERVAL	how often the script scheduler starts runs that are due (internal/platform/scriptexec)	2s

Both keep their previous defaults when unset, and both are documented in docs/server/notifications.md and docs/scripts/running.md.

dev/platform.yaml also sets:

• the webhook receiver's write_timeout to 3s;
• the compactor's poll to 2s;
• a top-level rate_limit of 12,000 requests per minute with a burst of 2,000.

The dev stack keeps the storage scan at 30s, because a faster scan races the criteria that seed storage usage.

Acceptance criteria changes:

• test(acceptance): #1694 escalation criterion outlives its 120s client context #1738 asserts the session's deadline instead of sleeping 135s.
• feat(webhooks): inbound webhook sources landing events as Parquet #1870's secret-rotation overlap polls until three 401s in a row instead of sleeping 22s; its compaction criteria poll at 2-3s.
• A failed OAuth refresh is recorded but never announced, so the operator who authorized the connection is the last to know #1694 waits 30s for escalation and 7s for one more sweep.
• A script cannot be deleted from the portal, only through an agent #1575 makes its schedule due, then waits two scheduler passes.
• Observability 9/11: database and object storage capacity and integrity #1899 shares one waitForLoopPass helper.

Not met: #2232's done condition asks for a measured serial run of the whole suite, which this PR does not include. Two criteria still take longer than 30s, for these reasons:

• feat(webhooks): inbound webhook sources landing events as Parquet #1870's compaction criterion waits on whole-minute windows and the minute-cadence cron.
• Observability 9/11: database and object storage capacity and integrity #1899's reconcile criterion waits on the 30s storage listing.

#2233 (running the criteria in parallel) is not done here. Lanes on one dev stack measured 47-51 minutes with failures caused by the load. The E2E Nightly already splits the suite into eight groups across machines.

Other changes

• test/acceptance/issue_2201_test.go: the expectations follow Storage forecast on a fresh install: a first-boot burst becomes a fill date and can raise exhaustion alerts; both replicas sample every tick #2203's rules (48 and 360 hours; the store with no growth spans 16 days). The seed re-inserts usage and reads it back until used_bytes matches.
• ui/package.json: vitest ^4.1.12, which fixes the osv advisories against @vitest/mocker 4.1.11.
• test/structure/testdata/allowed_internal_imports.txt: adds the edge pkg/admin -> internal/platform/portalcfg.

Acceptance

test/acceptance/issue_2242_test.go has seven criteria. They run against the dev stack with Keycloak, start replicas with DEV_PORTAL_LOGIN_REDIRECT and DEV_PORTAL_ALLOW_API_KEY_LOGIN, and drive the browser through ui/e2e/login-redirect. Covered:

• the redirect to Keycloak and the return;
• the branding fields;
• the key form hidden and shown through ?login=api_key;
• no redirect loop after a failed sign-in;
• an expired session;
• the setting ignored without OIDC.

Transcript: build/2242/acceptance.md. make acceptance-check passes for #1546, #1575, #1631, #1694, #1738, #1862, #1870, #1899, #2068, #2121, #2201 and #2242. The recorded #2242 run predates moving the rule into portalcfg; portalcfg_test.go and pkg/admin/system_test.go cover the same behavior.

make verify passes.

[codecov]

Codecov Report

❌ Patch coverage is 91.30435% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.84%. Comparing base (ad83295) to head (f0d0aef).

Files with missing lines	Patch %	Lines
internal/httpserver/alertwire/alertwire.go	50.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2250      +/-   ##
==========================================
- Coverage   94.84%   94.84%   -0.01%     
==========================================
  Files        1381     1381              
  Lines      111991   112010      +19     
==========================================
+ Hits       106220   106233      +13     
- Misses       5754     5760       +6     
  Partials       17       17              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.