feat: add capabilities panel to server status page (0.7.0)

[herbie-bot]

Summary

Extends createServerStatusPage with an optional capabilities config so a consuming app can surface runtime-capability availability on /admin/status. When provided, ServerStatusClient client-side fetches the app's capabilities endpoint (via the Next proxy, forwarding the IT-admin session) and renders one CapabilityStatus row per configured item.

This is the nextjs-app-layer half of the cross-repo HEIC-support-status feature (open-crm spec 112-heic-support-status). It pairs with @open-elements/ui#4 (the CapabilityStatus component), now published as @open-elements/ui@0.9.0.

API (backwards-compatible)

createServerStatusPage({
  auth,
  homeRoute,
  capabilities?: {
    endpoint: string;                 // e.g. "/api/admin/capabilities"
    items: ReadonlyArray<{
      id: string;                     // matches a boolean key from the endpoint
      label: string;
      availableText: string;
      unavailableText: string;
      hint?: string;
    }>;
  };
})

createServerStatusPage({ auth }) behaves exactly as before. The library stays app-agnostic — it knows only generic ids and the display strings the app passes in.

Fail-safe

Any capabilities-fetch failure or non-ok response resolves to an empty map, so every configured row renders as unavailable. An operator never sees a false "available".

Changes

• createServerStatusPage: new optional capabilities option, passed through to the client.
• ServerStatusClient: fetches capabilities.endpoint, renders CapabilityStatus rows, fail-safe on error/non-ok.
• Exported StatusCapabilitiesConfig / StatusCapabilityItem types for consumers.
• Bumped @open-elements/ui (peer + dev) to ^0.9.0; version 0.6.0 → 0.7.0.
• Lockfile pins @open-elements/ui@0.9.0; that exact version is exempted from the minimumReleaseAge supply-chain policy (freshly published first-party release).

Test coverage

• 5 new ServerStatusClient tests: no-config → health only (backwards compat); row-from-fetched-map (green); reported-false → unavailable; fetch-rejects → fail-safe; non-ok → fail-safe.
• CI green: typecheck / lint / format:check / full suite (36 tests) / build.

Next

Publish @open-elements/nextjs-app-layer@0.7.0, then re-run /spec-flow 112 in open-crm to add the backend /api/admin/capabilities endpoint and wire the status page.

Part of #6

🤖 Generated with Claude Code