feat(adminui): GET /api/deployments/{id}, the status resource the 202 Location names (R04 S5)

The deploy API's 202 pointed at a route that did not exist. The GET reads the
deployment (projected, no artifact blob) and its per-node apply states, and
carries the POST's own gate: API key in X-Api-Key, AllowAnonymous against the
cookie fallback, 503 while Security:DeployApiKey is unset.

Refs #745
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Api/DeployApiEndpoints.cs

@@ -3,8 +3,10 @@ using System.Text;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using ZB.MOM.WW.OtOpcUa.Commons.Interfaces;
+using ZB.MOM.WW.OtOpcUa.Configuration;
 using ZB.MOM.WW.OtOpcUa.Commons.Messages.Admin;
 
 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Api;
@@ -31,7 +33,8 @@ public static class DeployApiEndpoints
     /// <summary>Configuration key holding the deploy API secret.</summary>
     public const string ConfigKey = "Security:DeployApiKey";
 
-    /// <summary>Maps <c>POST /api/deployments</c> — the headless deploy trigger. No-op-safe to call
+    /// <summary>Maps <c>POST /api/deployments</c> — the headless deploy trigger — and
+    /// <c>GET /api/deployments/{id}</c>, the status resource its 202 <c>Location</c> points at. No-op-safe to call
     /// on any admin-role node; the handler self-disables (503) until <c>Security:DeployApiKey</c> is set.</summary>
     /// <param name="app">The endpoint route builder.</param>
     /// <param name="config">Application configuration (read for the deploy API key).</param>
@@ -62,9 +65,61 @@ public static class DeployApiEndpoints
         .DisableAntiforgery()     // machine endpoint, not a browser form post
         .WithName("StartDeployment");
 
+        // The status resource the POST's 202 Location points at (R04 S5). Same gate as the POST: the
+        // client that follows the Location is the automation holding the deploy key, not a browser
+        // session, so it is API-key gated (AllowAnonymous + the key check) rather than cookie-policy
+        // gated, and disabled (503) while the key is unconfigured.
+        app.MapGet("/api/deployments/{deploymentId:guid}", async (
+            HttpContext http,
+            Guid deploymentId,
+            IDbContextFactory<OtOpcUaConfigDbContext> dbFactory,
+            CancellationToken ct) =>
+        {
+            if (string.IsNullOrEmpty(configuredKey))
+                return Results.Problem(
+                    "Deploy API is disabled. Set Security:DeployApiKey to enable it.",
+                    statusCode: StatusCodes.Status503ServiceUnavailable);
+
+            if (!IsAuthorized(http.Request.Headers[ApiKeyHeader].ToString(), configuredKey))
+                return Results.Unauthorized();
+
+            await using var db = await dbFactory.CreateDbContextAsync(ct);
+            var status = await GetDeploymentStatusAsync(db, deploymentId, ct);
+            return status is null ? Results.NotFound() : Results.Ok(status);
+        })
+        .AllowAnonymous()         // gated by the API key, not the cookie auth fallback
+        .WithName("GetDeployment");
+
         return app;
     }
 
+    /// <summary>Reads one deployment and its per-node apply states, or null when the id is unknown.</summary>
+    /// <param name="db">The config DB context.</param>
+    /// <param name="deploymentId">The deployment id from the POST's response / Location.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>The status body, or null.</returns>
+    public static async Task<DeploymentStatusResponse?> GetDeploymentStatusAsync(
+        OtOpcUaConfigDbContext db, Guid deploymentId, CancellationToken ct = default)
+    {
+        // Projected: the deployment row also carries the (large) artifact blob, which a status poll never needs.
+        var deployment = await db.Deployments.AsNoTracking()
+            .Where(d => d.DeploymentId == deploymentId)
+            .Select(d => new { d.DeploymentId, d.RevisionHash, d.Status, d.CreatedBy, d.CreatedAtUtc, d.SealedAtUtc, d.FailureReason })
+            .FirstOrDefaultAsync(ct);
+        if (deployment is null) return null;
+
+        var nodes = await db.NodeDeploymentStates.AsNoTracking()
+            .Where(n => n.DeploymentId == deploymentId)
+            .OrderBy(n => n.NodeId)
+            .Select(n => new NodeDeploymentStatusResponse(
+                n.NodeId, n.Status.ToString(), n.StartedAtUtc, n.AppliedAtUtc, n.FailureReason))
+            .ToListAsync(ct);
+
+        return new DeploymentStatusResponse(
+            deployment.DeploymentId, deployment.RevisionHash, deployment.Status.ToString(), deployment.CreatedBy,
+            deployment.CreatedAtUtc, deployment.SealedAtUtc, deployment.FailureReason, nodes);
+    }
+
     /// <summary>Fixed-time compare of the supplied key against the configured secret. False when
     /// either is empty (so an unconfigured key never authorizes).</summary>
     /// <param name="provided">The caller-supplied key (from the <c>X-Api-Key</c> header).</param>
@@ -106,4 +161,26 @@ public static class DeployApiEndpoints
     /// <param name="DeploymentId">The new deployment id when one was created; otherwise null.</param>
     /// <param name="RevisionHash">The config revision hash, when known.</param>
     public sealed record DeployResponse(string Outcome, Guid? DeploymentId, string? RevisionHash);
+
+    /// <summary>Response body for <c>GET /api/deployments/{id}</c>.</summary>
+    /// <param name="DeploymentId">The deployment id.</param>
+    /// <param name="RevisionHash">The config revision hash the deployment carries.</param>
+    /// <param name="Status">The deployment's <c>DeploymentStatus</c> name.</param>
+    /// <param name="CreatedBy">Who/what initiated it.</param>
+    /// <param name="CreatedAtUtc">When it was created.</param>
+    /// <param name="SealedAtUtc">When it sealed; null while still dispatching/applying.</param>
+    /// <param name="FailureReason">The deployment-level failure reason, when any.</param>
+    /// <param name="Nodes">Per-node apply states, ordered by node id.</param>
+    public sealed record DeploymentStatusResponse(
+        Guid DeploymentId, string RevisionHash, string Status, string CreatedBy, DateTime CreatedAtUtc,
+        DateTime? SealedAtUtc, string? FailureReason, IReadOnlyList<NodeDeploymentStatusResponse> Nodes);
+
+    /// <summary>One node's apply state within a <see cref="DeploymentStatusResponse"/>.</summary>
+    /// <param name="NodeId">The cluster node id.</param>
+    /// <param name="Status">The node's <c>NodeDeploymentStatus</c> name.</param>
+    /// <param name="StartedAtUtc">When the node started applying.</param>
+    /// <param name="AppliedAtUtc">When the node acked; null while applying.</param>
+    /// <param name="FailureReason">The node's failure (or "Applied degraded: …") reason, when any.</param>
+    public sealed record NodeDeploymentStatusResponse(
+        string NodeId, string Status, DateTime StartedAtUtc, DateTime? AppliedAtUtc, string? FailureReason);
 }