Upgrade X4B fork to upstream hyperglass v2 HEAD

[splitice]

Description

Merge upstream fd34bda03fe3382cb14a00dc9ec76cf282bc3e0a into the X4B v1.0.4 fork while retaining both histories. Adopt upstream v2's API/UI and replace obsolete Redis, dependency, installer, and frontend workarounds.

Pin Python 3.12.12, Node 22.22.0, pnpm 10.11.0, and container base digests. Build the configuration-dependent UI offline at startup, cap Next.js build workers for the existing 2 GiB limit, and retry incomplete builds. Run Netmiko collection outside the API event loop with per-request async timeouts so simultaneous SSH queries do not block readiness or the UI.

Restore backend/frontend checks, add container smoke coverage, and publish immutable application-SHA tags only after checks on trusted main/tag pushes.

Related Issues

Coordinated deployment migration: https://github.com/X4BNet/k8s-hyperglass/pull/3

Motivation and Context

The deployed configuration is v1 and uses custom BIRD IPv6 commands. The companion change migrates it to explicit v2 directives and an input plugin, preserving all 16 locations and effective v1 query policy. It stages v2 beside v1 and keeps rollback to the existing deployment available.

Tests

• 47 backend tests; Ruff clean.
• 39 frontend tests; formatting, Biome, and TypeScript checks clean.
• 56 companion migration/deployment tests, including mocked SSH through the real API, caching, denied inputs, and GitOps preservation.
• Container cold start without package-registry access at 3 CPU / 2 GiB, mounted key permissions, assets, restart, missing-asset rebuild, and graceful shutdown.
• Browser query submission/result rendering with no JavaScript errors.
• Live SSH ping from all 16 locations; all five query types on Amsterdam/Brazil and IPv6 checks on Amsterdam. Three Brazil connection failures succeeded on retry. Readiness responded in 4 ms during two concurrent live SSH queries.
• GitHub workflows pass actionlint; shell scripts pass syntax checks.

Kubernetes rollout, image publication through the main/tag workflow, and 24-hour production monitoring remain pending. No Kubernetes context is available in the implementation workspace. See UPGRADE.md and the companion validation record.