scope frontend contracts to the feature, not to one file

93 test files read a single frontend source and asserted identifiers in it. The
MapWorkspace split showed what that costs: 24 tests went red for a move that
changed no behaviour at all. A contract belongs to the feature — a container,
its hooks, its domain layer — not to whichever file currently holds it.

232 read sites now resolve through read_feature(). The distinction that makes
this safe is direction: a *positive* contract ("this is wired") may widen,
because the identifier must still exist somewhere in the feature; a *negative*
one ("this component performs no transport") is a statement about one file, and
widening it would quietly weaken the check. The 73 single-file reads that
remain are exactly those, and a guard now enforces the rule for new tests.

Verified rather than assumed: of the 732 migrated positive assertions, 644 still
match exactly one module — as specific as before — and the other 86 already
spanned a container and its hook by nature. Two apparent misses are an artefact
of the checking regex reading an escaped newline literally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/test_sprint221_source_freshness_audit.py

@@ -7,6 +7,7 @@ from types import SimpleNamespace
 
 from app.models import Dataset, DatasetVersion
 from app.services.source_freshness_service import SourceFreshnessService
+from tests.frontend_contract import read_feature
 
 
 NOW = datetime(2026, 7, 16, 12, 0, tzinfo=timezone.utc)
@@ -231,8 +232,8 @@ def test_source_freshness_operator_and_ui_contract_are_read_only() -> None:
     script = (root / "scripts" / "audit_source_freshness.py").read_text(encoding="utf-8")
     dockerfile = (root / "deploy" / "unraid" / "Dockerfile.all-in-one").read_text(encoding="utf-8")
     readiness = (root / "scripts" / "run_readiness_check.sh").read_text(encoding="utf-8")
-    app = (root / "frontend" / "src" / "components" / "overview" / "OverviewWorkspace.tsx").read_text(encoding="utf-8")
-    api = (root / "frontend" / "src" / "services" / "api" / "datasets.ts").read_text(encoding="utf-8")
+    app = read_feature("shell")
+    api = read_feature("datasets")
 
     assert "Request(endpoint" in script
     assert "method=\"POST\"" not in script