Epic: V2 Operator Console — complete operator decision layer

[jmrGrav]

Goal

Make the V2 console the primary interface for every operational decision: threat assessment, ban approval, provider health, incident investigation — all without leaving the UI.

Shipped in v1.7.8

• Dashboard situation banner with inline stats
• Dashboard Current Incident panel
• Timeline typed event badges
• Trusted Networks per-provider summary cards
• Cloudflare 5-second operator checklist
• Command palette 8-item grid
• KPI hover animation
• Route loader overlay
• Action summary and priority badge helpers
• Density reduction

Remaining in v1.7.9

• WAF Events structured side panel (WAF Events: structured side panel with sections instead of raw JSON dump #216)
• Focus Incident cross-context panels (Focus Incident: add Related Incidents, Related IPs, CrowdSec decisions, and Cloudflare history panels #219)
• Pipeline observability widget (Pipeline observability — event lag + queue depth widget #223)
• Provider health matrix (Provider health matrix #226)

Planned for v1.8.0+

• Causal correlation engine — trace probe → ban → CF push
• Cross-page incident context persistence
• Predictive threat scoring (v1.9)

Design constraints

• Server-first HTML rendering (no SPA, no npm)
• Dark-only palette
• Go template rendering, no JS frameworks
• All actions must be defensible in a post-incident review

Quality bar

Every panel must answer one of:

1. What is happening right now?
2. What should I do about it?
3. What can I safely ignore?