feat(proxies): accept operator-provided dated egress observations for pool members - #15314

⚠️ base-red inherited: #15306

Summary

Adds an opt-in way for an operator to tell OmniRoute which exit addresses a pool member currently uses, with the date of the observation. Today the only source is OmniRoute's own echo probe, cached for a few minutes, which is wrong as soon as a member switches nodes behind one port. With PROXY_OPERATOR_EGRESS_ENABLED on, fresh rows are used for ordering and shown in the pool view as "operator-provided, dated"; a stale row counts as absent, and the freshest observation wins. Off by default: no behavior change without the flag.

Related Issues

• Closes feat(resilience): accept operator-provided dated egress observations for core entries #14897
• Related to feat(providers): Apply a local-core entry's set-aside without restarting the core #14702
• Related to [defer] feat(proxy): steer local core selector off set-aside members #14752

Validation

• Change type: routing
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward — rebased on the current release base; focused tests rerun
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxy-operator-egress-store.test.ts (new, 10 cases: schema rejections, idempotent upsert, freshest-wins, expiry, caps and eviction, concurrent pushes)
• tests/unit/proxy-operator-egress-route.test.ts (new, 11 cases: 404 flag off, 401 without auth, 400 all-rejected, 200 with ignored counting)
• tests/unit/proxy-operator-egress-reader.test.ts (new, 7 cases: 3-address set, freshness crossover both ways, flag-off identical, cache-then-expire)
• tests/unit/proxy-operator-egress-migration.test.ts (new, 1 case: table, key, index)
• tests/unit/proxy-operator-egress-i18n.test.ts (new, 1 case: keys present in all locales, component wiring)
• tests/unit/proxy-pool-member-egress-route.test.ts (updated: source: null in one pinned body)
• tests/unit/ui/PoolMemberEgressLines.test.tsx (updated: operator line, forward compatibility)
• tests/unit/feature-flags-settings.test.ts + tests/unit/server-owned-tool-loop-flag.test.ts (updated: flag count 80 to 81)

Coverage Notes

• src/lib/db/proxyOperatorEgress.ts: store, reader, route, migration tests
• src/lib/db/proxies/rotation.ts: reader tests (merged set, freshest, flag-off path)
• src/lib/proxyPoolEgressObservation.ts: reader and member-egress route tests
• src/app/api/settings/proxies/operator-egress/route.ts: route tests
• src/app/api/settings/proxies/pool/member-egress/route.ts: member-egress route tests
• src/app/(dashboard)/dashboard/settings/components/PoolMemberEgressLines.tsx: UI tests
• src/shared/network/egressAddress.ts: store and reader tests via validation paths
• src/shared/constants/featureFlagDefinitions.ts + src/shared/utils/featureFlags.ts + src/shared/validation/schemas/proxy.ts: pinned by flag count and route rejection tests

Reviewer Notes

• Behavior: Opt-in, default off: without the flag the route answers 404 and nothing is read. Incoming push only with no outbound calls, so there is no SSRF surface; every address is validated as a routable IP literal at the door and non-routable or future-dated rows are refused. Several addresses per member are declared as a set, not opacity: sharing one recently refused address counts on any of them, while the journal rule is unchanged.
• Merge: The sibling stack (feat(proxy-subscription): generate the local proxy-core configuration (opt-in) #15141/feat(proxy-subscription): verify the generated core configuration before replacing the file #15142/feat(proxy-subscription): reload the proxy core after a verified config replacement #15238/feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295) carries 197_proxy_subscription_core_config.sql and 198_proxy_subscription_core_binary.sql, which are not on the base yet; this PR takes 197 on the current base (--next-migration), so it merges after feat(proxy-subscription): generate the local proxy-core configuration (opt-in) #15141/feat(proxy-subscription): verify the generated core configuration before replacing the file #15142/feat(proxy-subscription): reload the proxy core after a verified config replacement #15238/feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295 (which carry 197/198 on their branches; the oldest claims the slot, the rest renumber), after perf(db): drop two conversation_turn_nodes indexes no query reads #15354 and fix(proxy-subscription): report internal core config failure distinctly #15377 (which also claim 197 on their branches): this PR renumbers on top once the first lands. Shares .env.example and docs/reference/ENVIRONMENT.md (append-only additions at distinct anchors) with fix(proxy-health): skip sweep probes already proven by recent production successes #14805, feat(proxy-subscription): verify the generated core configuration before replacing the file #15142, feat(proxy-subscription): reload the proxy core after a verified config replacement #15238 and feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295: either order. With fix(proxy-health): skip sweep probes already proven by recent production successes #14805, feat(proxy-subscription): verify the generated core configuration before replacing the file #15142, feat(proxy-subscription): reload the proxy core after a verified config replacement #15238, feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295, fix(proxies): set aside region-refused members briefly #15383, feat(dashboard): flag uniform provider 5xx regime and split upstream counts #15386, feat(i18n): forward the optional reasoning control in the translation backend #15462 and feat(proxy-subscription): warn with a translated count when generation skips entries #15564 (shared files): either order. Adds a migration; the migration counts in README, AGENTS.md and llm.txt stay as they are (they move with the release train), so check:docs-counts is red until then. The new rotation.ts read is one-way into the egress table (no return edge, cycle check passes with 0 cycles), so the shared-file order above covers it.