n8n: add backend endpoints for the RAGcore Procedure Sync workflow

GET /api/v1/integrations/n8n/procedures lists every procedure Markdown
file Fleet Ops ships (all languages) with a stable per-document id and
content hash, ready for workflow 3 to push into RAGcore. POST
.../procedures-sync-result records the sync outcome as an idempotent
audit event, matching the existing return-callback/workflow-error
pattern. Extracted frontmatter parsing out of the demo knowledge
provider into a shared module so both read the same source of truth.

backend/app/api/routers/integrations.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import uuid
 from datetime import UTC, datetime
+from pathlib import Path
 from typing import Any
 
 from fastapi import APIRouter, Depends, Header
@@ -13,9 +14,18 @@ from app.core.config import get_settings
 from app.core.errors import AppError
 from app.models.audit import AuditEvent
 from app.models.outbox import OutboxEvent
-from app.schemas import ScanResultOut, WorkflowErrorReportIn, WorkflowErrorReportResult
+from app.schemas import (
+    ProcedureDocumentOut,
+    ProcedureListOut,
+    ProcedureSyncResultIn,
+    ProcedureSyncResultResult,
+    ScanResultOut,
+    WorkflowErrorReportIn,
+    WorkflowErrorReportResult,
+)
 from app.services.audit import record_audit_event
 from app.services.data_quality import run_scan
+from app.services.knowledge.procedures import iter_procedure_documents
 
 router = APIRouter(prefix="/api/v1/integrations/n8n", tags=["integrations"])
 settings = get_settings()
@@ -146,3 +156,67 @@ def workflow_error(
         execution_id=body.execution_id,
         occurred_at=datetime.now(UTC),
     )
+
+
+@router.get("/procedures", response_model=ProcedureListOut)
+def list_procedures(service_token: str = Header(..., alias="X-Service-Token")) -> ProcedureListOut:
+    """Read-only source list for the RAGcore Procedure Sync workflow: every procedure
+    Markdown file Fleet Ops ships, across every supported language, with a stable
+    per-document id (source_id) and a content hash so the caller can detect changes
+    without re-fetching content it already has."""
+    if service_token != settings.n8n_callback_token:
+        raise AppError("UNAUTHORIZED_SERVICE", "Invalid service token.", status_code=401)
+
+    documents = [
+        ProcedureDocumentOut(
+            id=doc.source_id,
+            language=doc.language,
+            document_id=doc.document_id,
+            title=doc.title,
+            version=doc.version,
+            content=doc.content,
+            content_hash=doc.content_hash,
+        )
+        for doc in iter_procedure_documents(Path(settings.knowledge_dir))
+    ]
+    return ProcedureListOut(documents=documents)
+
+
+@router.post("/procedures-sync-result", response_model=ProcedureSyncResultResult)
+def procedures_sync_result(
+    body: ProcedureSyncResultIn,
+    service_token: str = Header(..., alias="X-Service-Token"),
+    db: Session = Depends(get_db),
+) -> ProcedureSyncResultResult:
+    """Receives a summary (counts only, no document content) from the n8n "Fleet Ops --
+    RAGcore Procedure Sync" workflow once it finishes uploading procedures to RAGcore.
+    Idempotent on execution_id, matching the workflow-error and return-callback pattern."""
+    if service_token != settings.n8n_callback_token:
+        raise AppError("UNAUTHORIZED_SERVICE", "Invalid service token.", status_code=401)
+
+    already_recorded = (
+        db.scalar(
+            select(AuditEvent.id).where(
+                AuditEvent.action == "n8n_procedures_synced",
+                AuditEvent.metadata_json["execution_id"].astext == body.execution_id,
+            )
+        )
+        is not None
+    )
+    if not already_recorded:
+        record_audit_event(
+            db,
+            actor_type="service",
+            actor_label="n8n procedure sync",
+            action="n8n_procedures_synced",
+            entity_type="automation",
+            after={"synced": body.synced, "failed": body.failed},
+            metadata={"execution_id": body.execution_id},
+        )
+        db.commit()
+
+    return ProcedureSyncResultResult(
+        status="already_registered" if already_recorded else "registered",
+        execution_id=body.execution_id,
+        occurred_at=datetime.now(UTC),
+    )