fix: publish RAGcore Procedure Sync and derive its evidence for real

MCP_HUB_BASE_URL had the same wrong-hostname bug as RAGCORE_BASE_URL earlier
this session (itworx-mcp-hub:8000 doesn't resolve; the real container is
reachable at the host's own 192.168.10.150:1100) -- fixed live, resolving the
Automation page showing "Operationeel" and "Hub Onbereikbaar" simultaneously.

Went on to actually publish the "Fleet Ops -- RAGcore Procedure Sync" n8n
workflow now that RAGcore is reachable: its own RAGcore Sync Token credential
had gone stale from the same rotation as the earlier one, so minted a fresh,
dedicated, minimally-scoped (sources:sync only) credential, verified a real
manual run (33 synced, 0 failed, result registered) before publishing.

That exposed a real, now-stale bug: derive_n8n_status() hardcoded this
workflow's evidence to None with a comment explaining it was unpublished --
true when written, false now. The workflow's own result-report callback
already writes a real n8n_procedures_synced audit event; wired that in as its
evidence source, the same pattern the scheduled scan and error handler already
use, instead of a value that could never update itself once the workflow went
live.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/services/integration_status.py

@@ -19,8 +19,7 @@ from app.schemas import (
 settings = get_settings()
 
 # The 4 canonical Fleet Ops n8n workflows (see n8n/workflows/MANIFEST.md). All 4 are
-# built (workflow 3, RAGcore Procedure Sync, has all 6 nodes saved); workflow 3 is not
-# yet published/active, so it will show no *run* evidence until it is.
+# built (all with their full node set saved).
 _CANONICAL_WORKFLOWS = (
     "Fleet Ops — Vehicle Return Orchestration",
     "Fleet Ops — Scheduled Data Quality Scan",
@@ -98,6 +97,16 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
         )
     )
 
+    # RAGcore Procedure Sync evidence: result reports posted by the workflow itself once
+    # it finishes uploading procedures to RAGcore (app/api/routers/integrations.py::
+    # procedures_sync_result), the same "the workflow's own callback is the evidence"
+    # pattern the scheduled scan and error handler already use below.
+    latest_procedure_sync_at = db.scalar(
+        select(func.max(AuditEvent.occurred_at)).where(
+            AuditEvent.action == "n8n_procedures_synced"
+        )
+    )
+
     # Error handler evidence: registrations posted by the "Fleet Ops — Workflow Error
     # Handler" n8n workflow itself, which also doubles as proof that workflow is wired
     # up and firing correctly.
@@ -123,7 +132,7 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
     evidence_by_workflow = {
         "Fleet Ops — Vehicle Return Orchestration": latest_success_at,
         "Fleet Ops — Scheduled Data Quality Scan": latest_scan_at,
-        "Fleet Ops — RAGcore Procedure Sync": None,
+        "Fleet Ops — RAGcore Procedure Sync": latest_procedure_sync_at,
         "Fleet Ops — Workflow Error Handler": latest_handler_failure_at,
     }
     workflows = [