feat: add Fleet operations view

backend/tests/test_frontend_shell.py

@@ -363,6 +363,7 @@ class FrontendShellTests(unittest.TestCase):
             "/assets/minerops-app.css",
             "/assets/minerops-app.js",
             "/assets/minerops-mine-map.js",
+            "/assets/minerops-fleet.js",
         ):
             with self.subTest(path=path):
                 response = self.client.get(path)
@@ -405,12 +406,76 @@ class FrontendShellTests(unittest.TestCase):
         self.assertIn("element.textContent = values.text", javascript)
         self.assertIn("cell.textContent = text(content)", javascript)
         self.assertIn("encodeURIComponent(repair.miner_id)", javascript)
-        self.assertIn("encodeURIComponent(miner.id)", javascript)
         self.assertIn("new AbortController()", javascript)
         self.assertIn("invalid repair response", javascript)
-        self.assertIn("invalid inventory response", javascript)
         self.assertIn("window.location.replace", javascript)
 
+    def test_fleet_page_is_semantic_responsive_and_permission_aware(self):
+        self.authenticate()
+        response = self.client.get("/assets/miners")
+        self.assertEqual(response.status_code, 200)
+        for value in (
+            'id="fleetFilters"', 'id="fleetRows"', 'id="fleetResultSummary"',
+            '<table class="fleet-table">', '<th>Operational</th>',
+            'id="fleetPrevious"', 'id="fleetNext"',
+            '/assets/minerops-fleet.js', 'data-can-view-locations="true"',
+            'id="fleetSite"', 'id="fleetRoom"',
+        ):
+            self.assertIn(value, response.text)
+
+        self.authenticate(permissions=("miners.view",))
+        restricted = self.client.get("/assets/miners").text
+        self.assertIn('data-can-view-locations="false"', restricted)
+        self.assertNotIn('id="fleetSite"', restricted)
+        self.assertNotIn('id="fleetRoom"', restricted)
+
+    def test_fleet_reset_action_has_a_visible_label(self):
+        self.authenticate()
+        response = self.client.get("/assets/miners")
+        self.assertIn(
+            '<button class="quiet-button" id="fleetReset" '
+            'type="button">Reset</button>',
+            response.text,
+        )
+        css = (STATIC_ROOT / "app.css").read_text(encoding="utf-8")
+        self.assertIn(
+            ".fleet-filter-actions .quiet-button { color: var(--ink); }",
+            css,
+        )
+
+    def test_fleet_script_dom_contract_matches_authorized_page(self):
+        self.authenticate()
+        response = self.client.get("/assets/miners")
+        source = (STATIC_ROOT / "fleet.js").read_text(encoding="utf-8")
+        declared = re.search(r"const ids = \[(.*?)\];", source, re.DOTALL)
+        self.assertIsNotNone(declared)
+        required = set(re.findall(r'"([A-Za-z][A-Za-z0-9]+)"', declared.group(1)))
+        required.update(("fleetSite", "fleetRoom"))
+        rendered = set(re.findall(r'\bid="([^"]+)"', response.text))
+        self.assertEqual(required - rendered, set())
+
+    def test_fleet_script_is_bounded_read_only_and_xss_safe(self):
+        source = (STATIC_ROOT / "fleet.js").read_text(encoding="utf-8")
+        self.assertEqual(source.count('fetch("/api/inventory/miners?"'), 1)
+        self.assertNotIn("/api/location/map", source)
+        self.assertNotIn("setInterval", source)
+        for method in ('method: "POST"', 'method: "PATCH"', 'method: "PUT"', 'method: "DELETE"'):
+            self.assertNotIn(method, source)
+        for unsafe in ("innerHTML", "insertAdjacentHTML", "document.write"):
+            self.assertNotIn(unsafe, source)
+        self.assertIn("textContent", source)
+        self.assertIn('"/miners/" + encodeURIComponent(miner.id) + "/detail"', source)
+        self.assertIn('"/monitoring/map?" + params.toString()', source)
+        self.assertNotRegex(source.lower(), r"stale.{0,20}(threshold|minutes|hours)")
+        self.assertNotIn("lowHashrate", source)
+
+    def test_fleet_css_has_status_text_mobile_cards_and_visible_focus(self):
+        css = (STATIC_ROOT / "app.css").read_text(encoding="utf-8")
+        self.assertIn('.fleet-row[data-status="offline"]', css)
+        self.assertIn("content: attr(data-label)", css)
+        self.assertIn(".fleet-pagination", css)
+        self.assertIn(":focus-visible", css)
+
     def test_styles_have_no_motion_to_reduce(self):
         css = (STATIC_ROOT / "app.css").read_text(encoding="utf-8")
         self.assertNotIn("animation:", css)