Module server 

Axum HTTP server for the trusty-console.

Why: The console needs a lightweight HTTP server that serves the embedded SPA, a JSON API route for service status, and a reverse-proxy layer for all daemon sub-paths. What: Builds an axum Router with:

• GET /health — liveness probe.
• GET /api/console/services — return cached snapshot (background poll).
• GET /api/console/metrics/{analyze,memory,search,review,mpm} — MCP-polled metrics.
• POST /api/webhooks/{source} — GitHub webhook ingress: verify once, spool durably, relay over UDS (#5089 step 3, ADR-0034). Mounted only by build_router_with_webhooks.
• GET /api/console/metrics/webhooks — oldest-pending spool age as a red health state.
• DELETE /api/console/memory/palaces/{id} — delete one palace via trusty-memory’s palace_delete on its socket (#6360).
• DELETE /api/console/search/indexes/{id} — delete one index via trusty-search’s own search.index.delete on its socket (#6360, #6285).
• GET /api/console/metrics/analyze/indexes — analyze index list via stdio MCP.
• GET /api/console/metrics/analyze/visualize?index=<id> — graph+entities+clusters.
• …/api/console/sessions/* — the single HTTP front door for the trusty-mpm session manager (#1222); handlers live in crate::routes::sessions.
• ANY /api/search/{*path} — translate the request into a trusty-search RPC call on its socket (#6285); see crate::search_uds.
• ANY /api/{service}/{*path} — reverse-proxy to live daemon via clean path (#1849 Phase 2); {service} ∈ {review, mpm, agents}.
• ANY /proxy/{daemon}/{*path} — DEPRECATED alias; routes to the same handler with a trace-level deprecation note.
• GET / and GET /ui/*path — serve the embedded Svelte SPA; the handlers live in crate::console_ui (#6285, 500-SLOC split).
• GET /tools/search/*path — serve the embedded trusty-search SPA (#6155); see crate::tools_ui.

All logs go to stderr; stdout is clean.

Test: The tests module starts the router in a real axum test client.

Structs

AppState

Shared application state injected into every route handler.

Functions

build_router

Build the axum Router with all routes wired, trusting only loopback as the write-origin self-origin.

build_router_with_self_origins

Build the axum Router with all routes wired, additionally trusting the given bind-derived, non-loopback self-origins for the write-origin guard.

build_router_with_webhooks

Build the router with the webhook ingress mounted (#5089 step 3).