[tim-smart]

The last group, labeling, moves onto HttpApi, and the raw Labeling routes go with it.

Cluster

• Api/Labeling.ts defines the group: listRepositories, getCatalog, getConfiguration, listActivity, listReconciliations, listAudit, getAiConsent and updateAiConsent. The activity query struct stays inline.
• Ingress/Labeling.ts serves it through HttpApiBuilder.group, merged in Routes.ts.
• The repository-scoped reads and the consent write fail with RepositoryNotFound. listReconciliations declares nothing, since it has no requireRepository check.
• LabelingOverviewError, AiConsentError, the ActivityReader failures (SQL, row decode, configuration) and LabelingConfigurationError die in the handlers. No service signatures change.
• Ingress/LabelingRoutes.ts and test/Ingress/LabelingRoutes.test.ts are deleted. The authenticated raw-router middleware now wraps only the live routes.

Web

• The workspace commands (FetchRepositories, FetchCatalog, FetchDetail, FetchConsent, SetConsent) and the activity journal's FetchActivity call api.labeling.*. RepositoryNotFound becomes "This repository is unavailable." Everything else falls back to each command's own copy through orElseSucceed.
• labeling-wire.ts is deleted, and its importers read @janitor/domain. The PR-review components get RepositoryOverview from @janitor/domain/Labeling/Reconciliation.
• The wire file also held display helpers, which now sit beside their domain types:
  • labelName, policyName and describeRevision go to Labeling/Policy/Configuration.
  • describeOutcome goes to Labeling/Policy/Program.
  • describePlan goes to Labeling/Reconciliation.
  • describeLocation was a copy of the existing formatNodeLocation, so callers use that instead.
• The editor's free-JSON forms stay in the web app. ProgramSource and formatSource move to policy-source/format.ts, and TestSubject and TestCandidates move to test-bench.ts.

Checks

At 9f3d7a8, in the Nix shell:

• vp check: 0 errors, 333 warnings.
• vp test: 132 files, 822 tests pass.

9f3d7a8 updates the fixtures in 8 web test files (routing, ai-prompt, policy-editor, pull-request-review-transcript, pull-request-reviews, repository-switcher, rule-editor and workspace). They now build ids and revisions with the domain .make(...) constructors, because they were typed against the old wire copies. No casts, assertions or new tests.

Closes EFF-2523