Implement managed browser security, individual agents and observability

apps/server/public/siem-admin.js

@@ -0,0 +1,9 @@
+// Export controls change the server delivery state, independently of browser diagnostics.
+let siemExportRevision=null,siemExportLoading=false;
+async function refreshSIEMExport(){if(siemExportLoading)return;siemExportLoading=true;try{fillSIEMExport(await api('/api/admin/siem'));$('siem-control-status').textContent='';}catch(error){$('siem-control-status').textContent=error.message;}finally{siemExportLoading=false;$('siem-save').disabled=!siemExportAllowed(currentPrincipal)||siemExportRevision===null;}}
+function siemExportAllowed(principal){return principal?.role==='admin';}
+function fillSIEMExport(data){siemExportRevision=data.revision;$('siem-enabled').checked=data.enabled===true;$('siem-status').textContent=`Security export ${data.enabled?'enabled':'disabled'} · ${data.configured?'HTTPS delivery':'local durable export'} · ${String(data.format||'ecs').toUpperCase()} · ${data.pending??0} pending · ${data.failures??0} delivery failures`;}
+const permissionsBeforeSIEM=applyOperatorPermissions;applyOperatorPermissions=function(principal){permissionsBeforeSIEM(principal);const allowed=siemExportAllowed(principal);$('siem-controls').hidden=!allowed;$('siem-enabled').disabled=!allowed;$('siem-save').disabled=!allowed||siemExportRevision===null;if(allowed&&siemExportRevision===null&&!siemExportLoading)void refreshSIEMExport();};
+const loadBeforeSIEM=load;load=async function(){await loadBeforeSIEM();if(!siemExportAllowed(currentPrincipal))return;try{fillSIEMExport(await api('/api/admin/siem'));$('siem-control-status').textContent='';}catch(error){siemExportRevision=null;$('siem-control-status').textContent=error.message;}applyOperatorPermissions(currentPrincipal);};
+$('siem-save').addEventListener('click',task(async()=>{if(!siemExportAllowed(currentPrincipal)||siemExportRevision===null)throw Error('Administrator access is required');try{const data=await api('/api/admin/siem',{enabled:$('siem-enabled').checked,expectedRevision:siemExportRevision},'PUT');fillSIEMExport(data);$('siem-control-status').textContent='Security export setting applied.';}catch(error){try{fillSIEMExport(await api('/api/admin/siem'));}catch{siemExportRevision=null;}throw error;}}));
+if(currentPrincipal)applyOperatorPermissions(currentPrincipal);