HM8 platform ops

All endpoints require X-HM8-Admin-Token header. Paths below are what you type into the browser at admin.hm8.biz; Caddy rewrites them to /api/v1/platform/... on the way to the API. No UI yet — JSON only.

Read-only

• GET /stats — workspaces / users / sources / jobs-by-status counts
• GET /workspaces — list all workspaces with member counts
• GET /workspaces/:id — single workspace: members, source count, rate limits
• GET /jobs/failed?limit=50 — recent failed processing jobs

RAG reconciliation (HM8-DB-COUNT-RECONCILE-001)

• GET /rag/inconsistency-report — sources with zero source_chunks rows, split by index_status. The readyButEmpty bucket is the canary: should always be 0 after prevention guards land.
• POST /rag/reingest-empty — re-queue every source in readyButEmpty. Safe to re-run.

RAG provider stats (HM8-OBS-RERANK-FALLBACK-001)

• GET /rag/provider-stats — counters since api boot for synthesis (Vertex vs Cohere fallback) and rerank (Cohere vs skip vs fail).

Mutations (audited in audit_log)

• PATCH /workspaces/:id/rate-limits — body: {rpmLimit, dailyRequestLimit, dailyTokenLimit}
• PATCH /workspaces/:id/timezone — body: {timezone} (IANA, e.g. Asia/Yerevan)
• POST /rag/reingest-all — fan out reingest jobs for every source with index_status='queued' across all workspaces. Used after the gemini-embedding-2 dim cutover migration.