M8: GUI polish, n8n workflow-3 fixes, RAGcore retrieval root-cause and fix

GUI: dashboard Attention Queue presents a curated severity mix instead of pure
severity-sort (grouped Now/Today/Later headers); Today's Movements seed data
curated so a fresh reset shows a credible day (2+ departures, 2+ returns), with
a new seed-integrity test; About Demo restructured into a compact grid with
progressive disclosure for technical sections; Duplicate Merge shows match/conflict
counts, hides matching fields by default, and previews the final merged record
before confirmation.

Repo hygiene: removed a stray empty `backend;C` directory and an untracked 31MB
zip export; `.gitignore` now excludes future archive exports.

n8n: fixed invalid JSON (a missing `},` between two node objects) in the committed
`fleet-ops-vehicle-return.json` -- the file could not be parsed. Live-validated
workflow 3 (RAGcore Procedure Sync): found and fixed a real defect (three body
parameters had a stray trailing `}}`) and a missing Error Workflow wiring, both
via the safe `n8n import:workflow` CLI path; exported the corrected, still-
inactive workflow as the new source of truth and updated MANIFEST.md/check_drift.py.
Publishing it (starts real daily unattended runs) remains a separate decision.

RAGcore: root-caused and fixed (live, approved) the "zero retrieval candidates"
bug -- a filesystem permission bug (`embedding_profiles.json` unreadable by the
app's own runtime user) that broke every retrieval call before it reached Qdrant.
Every other suspect (grants, scope resolution, Qdrant filters, embeddings) was
verified healthy first. Found a second, deeper gap: the reranker adapter calls
an Ollama HTTP route that does not exist on the deployed Ollama version, so
`/v1/answers` still returns `not_answerable`. `KNOWLEDGE_PROVIDER` stays `demo`
until that is resolved on the RAGcore side. Evidence-based MCP Hub integration
status (real tool-call audit history, not just a boolean flag) replaces the old
`configured`/`not_configured` guess. Full findings in
`docs/final-integrations/current-state-audit.md`.

Backend: 172 tests passing, ruff clean, mypy clean (50 files). Frontend: tsc
clean, production build clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/services/integration_status.py

@@ -8,12 +8,18 @@ from sqlalchemy.orm import Session
 from app.core.config import get_settings
 from app.models.audit import AuditEvent
 from app.models.outbox import OutboxEvent
-from app.schemas import N8nErrorHandlerStatus, N8nIntegrationStatus, N8nWorkflowEvidence
+from app.schemas import (
+    McpHubIntegrationStatus,
+    N8nErrorHandlerStatus,
+    N8nIntegrationStatus,
+    N8nWorkflowEvidence,
+)
 
 settings = get_settings()
 
-# The 4 canonical Fleet Ops n8n workflows (see n8n/workflows/MANIFEST.md). Workflow 3
-# (RAGcore Procedure Sync) is not built yet, so it always reports no evidence.
+# The 4 canonical Fleet Ops n8n workflows (see n8n/workflows/MANIFEST.md). All 4 are
+# built (workflow 3, RAGcore Procedure Sync, has all 6 nodes saved); workflow 3 is not
+# yet published/active, so it will show no *run* evidence until it is.
 _CANONICAL_WORKFLOWS = (
     "Fleet Ops — Vehicle Return Orchestration",
     "Fleet Ops — Scheduled Data Quality Scan",
@@ -92,7 +98,7 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
     workflows = [
         N8nWorkflowEvidence(
             name=name,
-            built=name != "Fleet Ops — RAGcore Procedure Sync",
+            built=True,
             last_seen_at=evidence_by_workflow[name],
         )
         for name in _CANONICAL_WORKFLOWS
@@ -117,3 +123,41 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
             latest_failure_workflow=latest_handler_failure_workflow,
         ),
     )
+
+
+def derive_mcp_hub_status(db: Session) -> McpHubIntegrationStatus:
+    """Evidence-based MCP Hub status: real tool-call audit history, not just the
+    `MCP_HUB_REGISTRATION_ENABLED` flag flipped on. Every `mcp_tool_request` call
+    already writes an `AuditEvent` (see `app/api/routers/mcp_integrations.py`)."""
+    total_calls = (
+        db.scalar(
+            select(func.count(AuditEvent.id)).where(AuditEvent.action == "mcp_tool_request")
+        )
+        or 0
+    )
+    latest_call_row = db.execute(
+        select(AuditEvent.occurred_at, AuditEvent.actor_label, AuditEvent.metadata_json)
+        .where(AuditEvent.action == "mcp_tool_request")
+        .order_by(AuditEvent.occurred_at.desc())
+        .limit(1)
+    ).first()
+    last_called_at = latest_call_row[0] if latest_call_row else None
+    last_client = latest_call_row[1] if latest_call_row else None
+    last_tool = (latest_call_row[2] or {}).get("tool") if latest_call_row else None
+
+    state: Literal["not_configured", "no_evidence", "operational"]
+    if not settings.mcp_hub_registration_enabled:
+        state = "not_configured"
+    elif total_calls > 0:
+        state = "operational"
+    else:
+        state = "no_evidence"
+
+    return McpHubIntegrationStatus(
+        registration_enabled=settings.mcp_hub_registration_enabled,
+        state=state,
+        total_calls=total_calls,
+        last_tool=last_tool,
+        last_client=last_client,
+        last_called_at=last_called_at,
+    )