PMM-15205 Ship SEP embedded in PMM (Tech Preview) - #5884

The embedded UI exchanges the PMM session for a SEP bearer rather than
carrying an injected static token.

Co-authored-by: Fábio Silva <ffjs1993@gmail.com>
Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Fabio Silva <ffjs1993@gmail.com>
Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Fabio Silva <ffjs1993@gmail.com>
Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

changeOrigin rewrites Host and Referer but not Origin, so Grafana's CSRF check
rejected state-changing requests through the dev proxy with a 403.

Co-authored-by: Fabio Silva <ffjs1993@gmail.com>
Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Peter Addo <peter.addo@percona.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Co-authored-by: Ignacio Durand <nachodurand@gmail.com>
Signed-off-by: Yan Orestes <yan.orestes@percona.com>
Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

PMM-15281 made sepEnabled a required field of ReadonlySettings. The mock that
has to satisfy that type, src/api/__mocks__/settings.ts, only reached main on
2026-09-02 with PMM-15302 (#5744) - after every UI checkpoint on this branch -
so the two met for the first time when the branch last merged main.

The merge was textually clean and left a type error behind: tsc fails with
TS2741 on READONLY_SETTINGS_MOCK. Nothing caught it because the branch had no
pull request of its own, so CI had never run on it.

false matches the default the provider ships and the value testUtils.tsx
already uses.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Ships the /sep/ nginx reverse-proxy configuration as first-class shipped configuration, replacing the hand-maintained overlay in SEP's feature-build harness. Gated on PMM_ENABLE_SEP; with the flag unset the only shipped delta is one inert glob include.

Adds PMM_SEP_ADDRESS (default sep:9000), validated before interpolation, with the resolver read from /etc/resolv.conf so the AMI and OVF images work under Podman's aardvark-dns.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT

Refreshes the four vendored spec files from SEP main c16578dfe and regenerates
the TS client. The previous sync watermark was 249f6738a (2026-08-25); 19 SEP
commits have touched the mirrored packages since.

Copied wholesale and formatted rather than hand-spliced, per the porting notes.
main.json's raw diff was pure reflow and collapses to nothing once oxfmt runs.

Endpoint-shape audit over the drift, which is the check that matters here
rather than the commit count:

  - All nine bare-array apiClient.get call sites still receive arrays:
    /api/admin/apps/, /api/apps/, /api/sep/hosts/,
    /api/sep/services/{id}/schemas, /api/sep/schemas/{id}/tables,
    /api/apps/atw/, /execution-events/{id}, and the two that already
    normalize either shape.
  - Three endpoints were removed, all inventory writes (SEP-1856). PMM does
    not vendor the inventory app and renders it generically from the schema
    the side-car serves, which no longer declares those forms or actions, so
    nothing in PMM reaches them.
  - Sixteen endpoints were added; all are additive.

This commit alone leaves @sep/api failing check-types, because SettingClassEnum
is gone from the spec. PMM-15440 immediately following resolves it.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

SEP-1825 lets an app declare its own settings class without editing core or
migrations, so the class travels as the Pydantic class __name__ - "SEPSettings",
"AlertsSettings" - rather than a member of a closed enum, and SettingClassEnum
is gone from the spec.

Not optional: with the refreshed spec, aliasing the removed schema is a
compile error.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

SEP-1779 lifted the duplicated search debounce into @sep/framework. It landed
before the 249f6738a sync watermark, but the sync that set that watermark
audited spec and endpoint shape rather than exports, so PMM never picked it up
and the hook is absent from the vendored framework.

Surfaced as a hard dependency: SEP-1956's Send dialog imports useDebouncedValue
from @sep/framework, so the next commit does not compile without it.

Ports the hook and its test only. PMM's own duplicated debounces -
CollectPane's SNIPPET_SEARCH_DEBOUNCE_MS and ScriptPreviewField's DEBOUNCE_MS -
are left alone; collapsing them onto this hook is SEP-1779's refactor and has
no bearing on the drift being closed here.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

…ider

Ports SEP-1956. The Send dialog resolves support case references against the
delivery provider as the user types instead of requiring an exact reference,
falling back to a plain text input when the deployment declares no case-search
section or the provider errors.

atw_config gained case_search_available, so useAtwConfig's error fallback
carries it too - without that the fallback no longer satisfies AtwConfig and
the regenerated client fails to compile.

SendDialog.tsx was byte-identical to SEP's pre-change copy once run through
PMM's formatter, so it is taken wholesale rather than hand-merged.

The test's case-search helper is indexed rather than destructured with a tuple
annotation: PMM typechecks the ATW tests where SEP does not, and mock.calls is
not a fixed-length tuple.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Ports SEP-1943's frontend arm. TaskHistoryStatusEnum gained UNLAUNCHABLE for an
execution whose Nomad node could not launch the requested interpreter, so the
history badge, the log-viewer badge and the ATW resend set all learn it. The
compiler enforced the first of those against the regenerated union.

The second half is a crash that predates SEP-1943 and is fixed on the way past.
FinishStatus never listed 'stale' while the SSE finish event forwards the
backend's status verbatim, so MAP['stale'] was undefined and reading .color off
it threw - blanking the whole log viewer for any stale task whose logs were
open. 'stale' joins the union and the map, and the badge now renders an
unrecognised status as its raw text rather than indexing into nothing, so the
next member added backend-side degrades instead of crashing.

unlaunchable and executor-gone deliberately share one entry: to an operator both
mean the node could not run this, not that the script failed.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Ports SEP-1942's frontend arm. A send log's step entries gained a `kind`
discriminator - resolution or upload - and `failed` joins the step status, so a
failed send says which step ended it rather than only that it ended.

`kind` is optional only for history: the backend writes it on every entry it
records now, but rows persisted before it existed carry entries without it.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Ports the frontend arm of SEP-1892. Scheduled tasks carry an optional
display_name alongside name; PluginTask did not declare it, so the friendlier
label the side-car sends was dropped on the floor.

PMM's copy calls this PluginTask where SEP calls it AppTask - the pre-rename
vocabulary the vendored packages still use.

The rest of SEP-1892 is inventory tombstone collection: backend-only, shipped
by the side-car.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Ports SEP-1818. A host field may now name a target_service; when it does, the
selector shows a non-blocking warning if the chosen executor's address differs
from the address of the node the service runs on. Choosing a non-co-located
executor stays legal - it is usually a mistake, and it used to fail late and
unhelpfully.

Co-location is compared on address alone: Nomad node names and inventory
display names are independent namespaces, so two hosts sharing an address are
one machine. An absent address is unknown rather than different, so the warning
stays silent whenever co-location cannot be established.

HostSelector.tsx had diverged too far from SEP's copy for a wholesale take -
272 lines apart after running SEP's baseline through PMM's formatter - so the
change is applied by hand. isHostMismatch and its test are taken verbatim.
Only HostField gains target_service; PMM vendors no MultiHostField.

Claude-Session: https://claude.ai/code/session_01RFUiQUpHgyaK6ozEQJ8wmT
Signed-off-by: Yan Orestes <yan.orestes@percona.com>

PMM-15205 Sync the vendored SEP frontend to c16578dfe