fix: bind deploy progress, request, and health gate to the captured node (#1357)

* fix: bind deploy progress, request, and health gate to the captured node

A deploy/update/install/git-apply re-read the active node from localStorage
independently at three points: the progress WebSocket at mount, the POST at call
time, and the health-gate poll. If the active node changed between the click and
any of those, the operation, its live output, and its health verdict could
target different nodes, and the socket and POST splitting across nodes broke
output streaming.

Capture the operation's node once when it starts and thread it through every
leg. A new nodeId option on apiFetch overrides the active-node read, the
progress terminal takes a nodeId prop for its socket URL, the health gate polls
on the captured node, and a failed gate records its recovery entry only on the
node it ran on. The surface, the request, and the gate now always agree.

* fix: scope failed-gate recovery to the file list's node and harden node targeting

Addresses review findings on the captured-node binding:

- Track the node the stack file list was fetched for (filesNodeId) and record a
  failed gate's recovery entry only when it matches the gate's node. This closes
  a race where switching back to the gate's node could match a same-named stack
  from the previous node's still-loaded list before the new list lands, keying
  the record to the wrong file and blocking the correct one. refreshStacks now
  carries a sequence token so an out-of-order resolution cannot leave files and
  filesNodeId inconsistent.
- Make an explicit apiFetch nodeId authoritative over a caller-supplied
  x-node-id header.
- Add the missing stack-logs nodeId cases (null, and active-node fallback) to the
  terminal tests.

frontend/src/lib/__tests__/api.test.ts

@@ -75,6 +75,50 @@ describe('apiFetch header merge', () => {
   });
 });
 
+describe('apiFetch nodeId override', () => {
+  it('targets the explicit node, overriding a different active node', async () => {
+    localStorage.setItem('sencho-active-node', '7');
+    await apiFetch('/stacks/foo/deploy', { method: 'POST', nodeId: 3 });
+    const init = lastFetchInit();
+    expect((init.headers as Record<string, string>)['x-node-id']).toBe('3');
+    localStorage.removeItem('sencho-active-node');
+  });
+
+  it('targets the local node (omits x-node-id) when nodeId is null, even with an active node set', async () => {
+    localStorage.setItem('sencho-active-node', '7');
+    await apiFetch('/stacks/foo/deploy', { method: 'POST', nodeId: null });
+    const init = lastFetchInit();
+    expect((init.headers as Record<string, string>)['x-node-id']).toBeUndefined();
+    localStorage.removeItem('sencho-active-node');
+  });
+
+  it('falls back to the active node when nodeId is undefined', async () => {
+    localStorage.setItem('sencho-active-node', '7');
+    await apiFetch('/stacks/foo/deploy', { method: 'POST' });
+    const init = lastFetchInit();
+    expect((init.headers as Record<string, string>)['x-node-id']).toBe('7');
+    localStorage.removeItem('sencho-active-node');
+  });
+
+  it('does not leak the nodeId option onto the outgoing fetch init', async () => {
+    await apiFetch('/stacks/foo/deploy', { method: 'POST', nodeId: 3 });
+    const init = lastFetchInit() as RequestInit & { nodeId?: unknown };
+    expect(init.nodeId).toBeUndefined();
+  });
+
+  it('keeps an explicit nodeId authoritative over a caller-supplied x-node-id header', async () => {
+    await apiFetch('/stacks/foo/deploy', { method: 'POST', nodeId: 3, headers: { 'x-node-id': '99' } });
+    const init = lastFetchInit();
+    expect((init.headers as Record<string, string>)['x-node-id']).toBe('3');
+  });
+
+  it('drops a caller-supplied x-node-id when the explicit nodeId is null (local)', async () => {
+    await apiFetch('/stacks/foo/deploy', { method: 'POST', nodeId: null, headers: { 'x-node-id': '99' } });
+    const init = lastFetchInit();
+    expect((init.headers as Record<string, string>)['x-node-id']).toBeUndefined();
+  });
+});
+
 describe('withDeploySession', () => {
   it('uses the canonical header name (kept in sync with the backend)', () => {
     expect(DEPLOY_SESSION_HEADER).toBe('x-deploy-session-id');

frontend/src/lib/api.ts

@@ -4,6 +4,13 @@ export interface ApiFetchOptions extends RequestInit {
   /** When true, omits the x-node-id header so the request always targets
    *  the local node regardless of which node is currently active in the UI. */
   localOnly?: boolean;
+  /** Explicit node target, overriding the active-node read. A number targets
+   *  that node; null omits x-node-id so the request hits the local node. Leave
+   *  undefined for the default (read the active node from localStorage). Lets an
+   *  operation stay bound to the node captured when it started, even if the
+   *  active node changes mid-flight. Takes precedence over localOnly when both
+   *  are set. */
+  nodeId?: number | null;
 }
 
 /** Header carrying a deploy's progress-stream correlation id. Mirrors the
@@ -31,17 +38,35 @@ export async function apiFetch(
   endpoint: string,
   options: ApiFetchOptions = {}
 ): Promise<Response> {
-  const { localOnly, ...fetchOptions } = options;
+  const { localOnly, nodeId: nodeIdOverride, ...fetchOptions } = options;
   const url = `${API_BASE}${endpoint}`;
-  const activeNodeId = localOnly ? null : localStorage.getItem('sencho-active-node');
+  // An explicit nodeId (including null) wins over the active-node read so a
+  // captured operation node stays authoritative; null means target the local
+  // node, not the stored active node.
+  let activeNodeId: string | null;
+  if (nodeIdOverride !== undefined) {
+    activeNodeId = nodeIdOverride === null ? null : String(nodeIdOverride);
+  } else if (localOnly) {
+    activeNodeId = null;
+  } else {
+    activeNodeId = localStorage.getItem('sencho-active-node');
+  }
 
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+    ...(activeNodeId ? { 'x-node-id': activeNodeId } : {}),
+    ...(fetchOptions.headers as Record<string, string> | undefined),
+  };
+  // An explicit nodeId is authoritative: a caller-supplied x-node-id header must
+  // not silently override the captured operation node (it would for the default
+  // active-node read, which is the pre-existing behavior left unchanged).
+  if (nodeIdOverride !== undefined) {
+    if (activeNodeId) headers['x-node-id'] = activeNodeId;
+    else delete headers['x-node-id'];
+  }
   const defaultOptions: RequestInit = {
     credentials: 'include',
-    headers: {
-      'Content-Type': 'application/json',
-      ...(activeNodeId ? { 'x-node-id': activeNodeId } : {}),
-      ...fetchOptions.headers,
-    },
+    headers,
   };
 
   // Drop headers from fetchOptions before the outer spread so the merged