feat(iwooos): expose wazuh managed host coverage readback

apps/web/src/lib/api-client.ts

@@ -268,6 +268,56 @@ export interface IwoooSWazuhOwnerEvidencePreflightResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhManagedHostCoverageHost {
+  node_id: string
+  role: string
+  readback_status: string
+  readback_status_label: string
+  next_gate: string
+  next_gate_label: string
+  manager_registry_accepted: boolean
+}
+
+export interface IwoooSWazuhManagedHostCoverageResponse {
+  schema_version: 'iwooos_wazuh_managed_host_coverage_readback_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  summary: {
+    expected_host_scope_count: number
+    manager_service_active_observed_count: number
+    manager_api_unauthenticated_response_count: number
+    manager_transport_established_connection_count: number
+    direct_agent_active_observed_count: number
+    direct_agent_transport_observed_count: number
+    direct_agent_missing_or_no_transport_count: number
+    ssh_readback_blocked_count: number
+    manager_registry_accepted_count: number
+    manager_registry_gap_count: number
+    dashboard_api_degraded_observed_count: number
+    live_metadata_env_enabled_count: number
+    active_response_authorized_count: number
+    host_write_authorized_count: number
+    agent_reenroll_authorized_count: number
+    agent_restart_authorized_count: number
+    runtime_gate_count: number
+    host_scope_matrix_count: number
+    required_evidence_before_green_count: number
+    required_evidence_accepted_count: number
+  }
+  host_scope_matrix: IwoooSWazuhManagedHostCoverageHost[]
+  required_evidence_before_green: Array<{
+    evidence_id: string
+    accepted: boolean
+  }>
+  operator_interpretation: string[]
+  forbidden_completion_claims: string[]
+  forbidden_actions: string[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSSecurityControlCoverageDomain {
   domain_id:
     | 'high_value_asset_control'
@@ -508,6 +558,11 @@ export const apiClient = {
     return handleResponse<IwoooSWazuhOwnerEvidencePreflightResponse>(res)
   },
 
+  async getIwoooSWazuhManagedHostCoverage() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-managed-host-coverage`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhManagedHostCoverageResponse>(res)
+  },
+
   async getIwoooSSecurityControlCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/security-control-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSSecurityControlCoverageResponse>(res)