CONTRACT: feat(ui-server): prepare durable turn egress records

[schlessera]

Refs #1665

What changed

Adds the typed egress_connection governance event and an internal per-turn proxy recorder. Real completed/refused HTTP connections persist host, port, method, visible path, bytes, duration and outcome in SQLite; recorder failure cancels the owning turn. Outward destinations wait for the existing approval bridge, and voice has no approval surface. The ordinary turn runner and both backend defaults remain unchanged.

Why this shape

This is the independent server recording prerequisite from #1665. The combined ordinary activation draft remains unpublished because actual managed-storage server qualification, supported custom-origin/native authentication compatibility, Pi integration and the complete first-party/socket gate remain unfinished. It adds no public extension seam or new credential authority.

Proof

Current head 15609967cb233ca76812440f398ecc3ea0b1a049, source tree e6c647d5e62a23a2a61ae72d485c936f48f28488, original base 775eb17aab740fa759c2182f306c38fc17acbcbe. Current live base additionally contains the unrelated SDK worker-placement test correction from #2389; original receipts retain their source attribution.

• Current proxy, inference relay, SQLite recorder, event schema and citation checks: 87 tests /444 assertions pass. The proxy/relay/recorder subset passes 29 tests /158 assertions after the final restoration.
• Policy allows zero bytes. The previous proxy constructor rejected that policy; failing-first and restored mutation fail TURN_EGRESS_ZERO_CAP_ADMISSION_VALID. The correction admits the zero ceiling and refuses real HTTP/inference requests before upstream contact or credential resolution, retaining zero-byte connection/denial records. Negative, fractional, nonfinite and unsafe integer ceilings remain refused.
• Original recorder-failure mutation fails TURN_EGRESS_FAILED_RECORD_ABORTS; restoration passes. The correction preserves that production helper and cancellation behavior.
• Strict types, lint and full pending changeset plan pass. Local diagnostic copies were retained outside the tree after their absolute import paths tripped leakage lint; no lint exclusions were added.
• Final required preflight on current source passed metadata/lint and 446 fast tests /17 files /0 failures. Import-graph feedback was deliberately stopped through the owned runner after the second manual issue closure and before repeating known invalid physical /tmp storage failures (child exit 143, preflight exit 1). This is incomplete, with no full passing preflight claim.
• Historical original preflight remains failed/incomplete: physical filesystem free space was below the unchanged default floor (test(ui-react): attribute scope freeze refusal dropping queued recovery replies #2394). A distinct complete bounded-filesystem run finished 2373 pass /8 fail: three share-confirmation setup timeouts (test(ui-react): attribute initial share confirmation stalls before ownership proof #2401), four socket fixtures lacking a non-loopback local interface, and one settled-success cancellation case whose hardcoded /tmp root still hit the host disk floor.
• Separate controls preserve those failed results: all four original socket cases pass with an isolated self-interface and no external route; all three original share cases pass in a fresh process, without establishing the earlier combined failure's cause. A cancellation diagnostic variant using the valid temporary root passes unchanged assertions; the unmodified cancellation fixture is not claimed green.
• At the previous server-only head, affected unit discovery omitted the importing share test (ci: reconcile cross-workspace test consumers with selected proof inventories #2404). The genuine SDK correction now expands the normal affected-workspace closure to UI React and both backends; CI selection has not been modified. Selected ready-PR proof remains pending.

Checklist

• Focused preflight and all selected hosted proof passed with actual checkout identities.
• Partial delivery and unchanged remaining acceptance are stated below.
• PR and advanced ui-sdk: give governed and strict workers a private network with a recorded, limitable egress proxy #1665 milestone read back before merge.
• Server minor changeset for the additive HTTP payload and SDK patch for the zero-byte correction are included.
• Leakage checks cover the diff and this body.
• HTTP integration contract and event documentation updated together.
• Provider turn history is unchanged.

Anything left open

#1665 was manually closed again after the retained owner reopen, without a closing commit or comment. This PR does not treat that closure as implementation delivery. Coordinated ownership reconciliation is pending; all original ordinary activation and compatibility/security/runtime/measurement criteria remain undelivered by this partial contribution. #1666/#1667 remain blocked on that output; #1673 remains downstream. Local Pi preparation stays dormant/unpublished. #2364 preserves persistent private-publication history incompatibility. #2284 remains stopped and unresolved; this contribution neither investigates nor changes host-writer lifetime admission.

The separate local actual server/WebSocket attempt stopped before container/loop creation: the ambient Docker image inspection hung, and subsequent explicit original-socket controls with fresh configuration and bounded deadlines also timed out. Those are failed prerequisites, not native proof; no retry or scope reduction supplies a passing claim. Earlier full native PR #2361 proof retains its own exact source attribution.