Authenticated user/validator/operator dashboard views, RBAC, and E2E tests (remainder of #14)

[flo2517]

Split off from #14 once its first slice (richer read-only provider view: storage, bandwidth, reputation vector, finalized on-chain offer, all with explicit unavailable/no-record-yet states) landed. This tracks the substantially larger remainder of #14's acceptance criteria:

• User views: workload submission, requirements, lease, lifecycle, cost estimate, usage, events, logs/metrics references, stop/retry actions — needs a tenant-authenticated dashboard surface built on Build authenticated user and workload API with tenancy boundaries #12's userauth (bearer API key), scoped queries (WHERE owner_id = ?), and a workload detail page. None of this exists; the current dashboard has zero authentication and shows all providers/workloads to anyone who can reach it (loopback-only in non-dev deployments).
• Validator views: challenge queue, evidence, quorum, weight submissions, score history, validator health — needs new blockchainbridge reads against pallet-network-validator's Evidence/Rounds storage (only ActiveNetworkValidators exists today).
• Operator views: dependency health, workers, queue depth, retries, alerts, audit events — /readyz covers basic Postgres/Redis/chain health; nothing surfaces worker/queue/retry state or alerting.
• RBAC and tenant isolation on the dashboard itself (today: no auth at all).
• Secret redaction audit across every dashboard field (today: no secrets are exposed, but this hasn't been reviewed as a stated requirement).
• Pagination and bounded cardinality beyond the existing hardcoded LIMIT 500/LIMIT 100.
• Responsive accessibility (WCAG-level review; today only a CSS overflow:auto + white-space:nowrap table wrap and two mobile breakpoints exist).
• API/E2E tests for the dashboard beyond the current JSON-contract unit tests.
• A migration path from the MVP same-origin UI to decentralized static hosting — not written up anywhere yet.

Likely needs its own design pass (or ADR, if it changes the auth/hosting model) before implementation, given the size.

🤖 Filed by Claude Code during autonomous v0.3 milestone work, per user's standing instruction to open issues for scope discovered along the way.

[flo2517]

Reopening — this was closed by accident. PR #81's body said "Does not close #76", but GitHub's auto-close keyword matcher matches the substring "close #76" regardless of the preceding "not". #76's remaining scope (Sr25519 verification, wallet-extension support, operator/validator dashboard views, RBAC roles, pagination, accessibility, E2E tests, decentralized-hosting migration path) is still open.

[flo2517]

Sr25519 wallet-login signature verification landed (PR #84) — closes that part of the remaining scope. Still open: wallet-extension client integration (Polkadot.js/Talisman), operator/validator dashboard views, RBAC roles, secret redaction audit, pagination, accessibility review, API/E2E tests, decentralized-hosting migration path.