fix(dashboard): high-impact metric reflects active filters + codebase audit

[edu-diaz]

Summary

• Fix high-impact metric: The "high impact" count in the dashboard stats bar now updates dynamically based on all active filters (name, source, and status). Previously it used baseFiltered which intentionally excluded the status filter for pill counts, but the high-impact number should reflect the currently visible set.
• Extract shared filtering helpers: countHighImpact() and filterServices() extracted into format.ts as tested, reusable functions. This consolidates duplicate filtering logic between StatsBar.svelte and ServiceListView.svelte.
• Add 17 tests: Full coverage for countHighImpact (threshold, edge cases) and filterServices (name, source, status, combined filters, and the specific high-impact-with-status-filter scenario).

What changed

File	Change
StatsBar.svelte	Derive fullyFiltered (applies status filter on top of baseFiltered), use countHighImpact()
format.ts	Add countHighImpact() and filterServices() shared helpers
format.test.ts	17 new tests for the helpers
ServiceListView.svelte	Use filterServices() instead of inline duplicate filtering logic
ui/	Rebuilt production bundle

Codebase audit findings

What was reviewed

• Full Go backend (pkg/, internal/)
• Dashboard frontend (pkg/dashboard/frontend/src/)
• All documentation (docs/, README.md)
• Validation layer (pkg/validation/crossfield.go)
• Stale comments (grep for TODO/FIXME/HACK/XXX)

What was found and addressed

• Bug: High-impact metric not reacting to status filter → fixed
• DRY violation: Filtering logic duplicated between StatsBar and ServiceListView → extracted to filterServices()
• Testability: High-impact threshold was an inline magic number → extracted as HIGH_IMPACT_THRESHOLD constant

What was found but intentionally NOT changed

• Validator duplication in crossfield.go: The four validateXxxNamesUnique functions and the validateHealthInterface/validateMetricsInterface pair follow identical patterns. A generic helper could save ~60 lines, but the current explicit approach is more readable and debuggable. Each validator has distinct error codes and field paths, making the duplication intentional and low-risk. Not worth the abstraction cost.
• Server struct size (pkg/dashboard/server.go): The Server struct has grown to 16 fields with multiple concerns (routing, aggregation, enrichment, caching). This is acknowledged complexity given the dashboard's scope. Would benefit from extraction into a SourceManager if it grows further, but no action needed now.
• Architecture docs: The dashboard section in docs/architecture.md could be expanded to better reflect the actual scope (20+ source files, 27 types), but the current documentation is accurate — just concise.
• Documentation: README, quickstart, architecture, CLI reference, and all feature docs were audited and found to be accurate and aligned with the implementation. No stale content detected.
• No stale comments: Zero TODO/FIXME/HACK/XXX markers in the entire Go codebase.

Test plan

• Frontend tests: 217 tests pass (5 files, including 17 new tests)
• Go tests: all packages pass
• go vet: clean
• Frontend build: compiles successfully
• Verify high-impact count updates on status filter change
• Verify high-impact count updates on name filter
• Verify high-impact count resets when filters are cleared
• Verify combined filters work correctly