feat(ep-td+dashboard): complete CUST-WP-0004 EP/TD tracking workstream

EP catalogue (all domains):
- EP-RAIL-001 ep_id patched (schema fix: add ep_id to EPUpdate)
- EP-RAIL-003 (git bare-repo mirrors) and EP-RAIL-004 (offsite secondary
  backup) registered from railiance-cluster/docs/backup-restore.md
- EP-CUST-003..007 ep_ids assigned to existing custodian EPs
- EP-CUST-008 (State Hub API auth) and EP-CUST-009 (update_workstream MCP
  tool) registered as new custodian extension points

TD catalogue (railiance — first 5 items):
- TD-RAIL-001: backup cron runs as root without audit trail (high/security)
- TD-RAIL-002: k3s kubeconfig world-readable mode 644 (medium/security)
- TD-RAIL-003: no Ansible role unit tests (medium/test)
- TD-RAIL-004: age key extracted via awk — fragile (medium/impl)
- TD-RAIL-005: etcd snapshot retention uncoordinated (low/impl)

Dashboard (T08 + T10):
- Extract API URL and POLL to src/components/config.js; all 15 pages
  now import from the shared module (contributions/goals keep custom POLL)
- Shared .kpi-infobox, .filter-bar, .filter-search/.filter-owner CSS
  moved to observablehq.config.js head <style> block; removed from 9 pages
- Build: 0 errors, 0 warnings

API (T09):
- progress.py: limit param now Query(100, le=1000) — prevents unbounded
  list requests; closes TD-CUST-004 for the only endpoint that had limit

CUST-WP-0004 marked completed (all 10 tasks done).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/CUST-WP-0004-ep-td-tracking.md

@@ -3,12 +3,13 @@ id: CUST-WP-0004
 type: workplan
 title: "Extension Points & Technical Debt Tracking"
 domain: custodian
-status: active
+status: completed
 owner: custodian
 topic_slug: custodian
 state_hub_workstream_id: e84ecd70-b276-4a93-a298-1ef1299b7c22
 created: "2026-02-27"
-updated: "2026-02-28"
+updated: "2026-03-11"
+completed: "2026-03-11"
 ---
 
 # Extension Points & Technical Debt Tracking
@@ -87,7 +88,7 @@ endpoints).
 ```task
 id: CUST-WP-0004-T05
 state_hub_task_id: 00492d87-3bb7-4df9-8f12-a06da0307fbc
-status: todo
+status: done
 priority: medium
 ```
 
@@ -99,7 +100,7 @@ Register findings as `TD-RAIL-xxx` items via the `/technical-debt/` API.
 ```task
 id: CUST-WP-0004-T06
 state_hub_task_id: 3069aa1d-3d5f-4b9f-be8b-dfa0ffe690fe
-status: todo
+status: done
 priority: medium
 ```
 
@@ -112,7 +113,7 @@ gaps, integration opportunities.
 ```task
 id: CUST-WP-0004-T07
 state_hub_task_id: 3a355a74-237f-4572-af05-683eceb32694
-status: todo
+status: done
 priority: low
 ```
 
@@ -123,7 +124,7 @@ Identify and register extension points in railiance as `EP-RAIL-xxx` items.
 ```task
 id: CUST-WP-0004-T08
 state_hub_task_id: a9b5d39e-706b-4f71-8f5d-ce4f927b3e4c
-status: todo
+status: done
 priority: high
 ```
 
@@ -136,7 +137,7 @@ variable.
 ```task
 id: CUST-WP-0004-T09
 state_hub_task_id: 7050eb96-964d-4c06-a9f5-6d49db6b9c98
-status: todo
+status: done
 priority: high
 ```
 
@@ -149,7 +150,7 @@ technical_debt) to prevent memory exhaustion.
 ```task
 id: CUST-WP-0004-T10
 state_hub_task_id: c54553be-d947-4b8d-9c16-eb1a0e9ae3a0
-status: todo
+status: done
 priority: medium
 ```