Release v2.0.0

[dmichael-fastly]

Release v2.0.0

A major architecture-cleanup release plus the feature work that landed
alongside it. The largest backend modules were carved into per-concern
packages (with re-export shims), telemetry moved to OpenTelemetry + structlog,
tenancy gained a typed RequestContext boundary that can't be constructed
without enforcing service access, and the frontend's hydration/navigation
warm-up was replaced with policy. Composite analytics endpoints land as a hard
cutover — frontend and backend ship together.

Full, categorized notes in CHANGELOG.md.

Highlights

• Package carve-ups — metadata_db, share_db, rollups, admin,
  session_scoring, duckdb, iceberg, and scheduler split into
  per-concern packages with re-export shims so existing imports keep working.
• Typed tenancy boundary — a single RequestContext dependency that can't
  be built without enforcing service access (23 analytics endpoints across 8
  routers).
• Telemetry — OpenTelemetry + structlog; uvicorn access logs bridged
  through the structured root handler.
• Session scoring — in-UI redeploy + edge-drift warning, fail-open
  breakdown card, and explicit operator opt-in for edge Layer-2 enforcement
  (no clock-driven monitoring→blocking ramp; deployment age is advisory only).
  NGWAF skip-inspection on the internal scoring sub-fetch.
• Observability + ops hardening — every request mints a correlation id
  (rid) that threads through the access log and a persistent slow-query
  history; richer admin health snapshot and a deeper /api/health probe.
• Human-readable PoP/ASN labels across the network, shielding, and origin
  views, from one shared component seeded by /api/bootstrap.
• Inline backend-failure surfacing — no more silent spinners or fabricated
  zeros; analytics reads typed through the generated OpenAPI schema.
• Reliability — opt-in DuckDB instance-recycle to bound the object-cache
  leak, now with backpressure so reads queue rather than fail during the brief
  recycle drain; self-healing reclaim of raw files stranded by an interrupted
  delete; orphaned-sync-row reaper.
• Consolidation + gates — three SQLite pools collapse into one
  ThreadLocalPool; a shared per-hour rollup writer; cron-tail helpers. New CI
  gates: frontend ESLint ceiling, Rust scorer cargo test, import contracts,
  and an OTEL console-exporter guard.
• Dependencies — freshness sweep across Python, frontend, and the scorer.

Docs & release prep

• README, AGENTS.md, and CHANGELOG.md refreshed to match the shipped code.
• Comment hygiene pass across the tree: stale, redundant, and duplicate-divider
  comments removed and embedded changelog blocks (the CI coverage gates, the
  ESLint ceiling) condensed to their conventions. Load-bearing rationale,
  incident references, and functional directives left intact.
• Release hygiene: Docker images pinned to the same Python as CI and mypy
  (3.13); dropped an orphaned server-only dependency and its stale knip
  waivers; stopped tracking the regenerated tests/perf/latest.json (the
  committed baseline.json stays the gate input); removed a dead logging
  helper and corrected a stale metric_snapshots docstring.
• App version is 2.0.0 across pyproject.toml, frontend/package.json,
  backend/main.py, and the committed OpenAPI snapshots; corrected a stale
  1.2.0 reference in docs/adr/12-api-versioning.md.
• make dev is now a real Makefile target.
• A bare ./run.sh honors the documented default ports (3000/8000) for fresh
  clones while still guarding an explicitly-chosen tunnel port.
• Removed the retired localhost.run sharing mode from the share UI (the
  backend dropped it in v2.0; it was still the default radio).

Validation

• Backend pytest: green. Frontend vitest: 971 passed; tsc --noEmit clean;
  ESLint at ceiling.
• Full pre-push gate passed: ruff, mypy, OpenAPI regen (no drift), frontend
  typecheck, security-regression count, and the Rust scorer cargo test.