feat: guide monitor setup through baseline learning

[crypt0rr]

New monitors now follow Targets → Coverage → Schedule and alerts → Review, then open a job page that explains the first scan and remaining baseline samples. Users can switch to advanced creation without losing their non-secret draft, choose full or partial coverage explicitly, and review the server's estimated probe work before saving.

POST /api/v1/jobs/preview shares creation policy, installed exclusions, pinned profile validation, routing and tenant permissions. It performs no scan, DNS lookup, write, notification or scheduling. Creation and execution revalidate current state. Administrators can create/test a notification destination inside setup; operators select existing destinations or continue without alerts. Credentials remain transient and write-only.

Creation and scan start remain separate operations. An ambiguous create outcome blocks resubmission; scan retry uses the saved job. Job detail derives learning, stalled/resumable work, and valid empty baselines from persisted observations while preserving explicit baseline approval and incomplete-scan protections.

Closes #1267.
Closes #1268.
Closes #1269.
Closes #1270.
Refs #1266 and #1271; final tracking issues close after production guides and release verification. Based on the merged Go 1.27.2 security fix #1265 / #1273. Keep the persistent dependency dashboard #8 open.

Validation:

• Fresh-head CI passes all frontend, Go, security, container, native ARM64 sandbox, CodeQL and documentation gates.
• Frontend: 561 tests pass; coverage and all 15 gate fixtures pass; changed executable-line coverage 86.92%.
• Browser: 151 pass, 245 intended project-filter skips, zero failures in both CI and the isolated local full run. Covers real-backend creation/restart/baseline learning, roles and unit isolation, keyboard feedback, and every guided step at 320px/375px.
• Full local go test -race -timeout=25m -coverprofile=coverage.out ./... and vet pass. Local aggregate Go coverage is 88.2% across 15 production packages (CI 88.1%); changed executable-line coverage is 95.61%. Whole-release-range security checks pass: lint 0 issues, no reachable Go vulnerabilities, npm audit 0 vulnerabilities.
• Docs: build and 1,346 local links/assets pass. Commit-matched Cloudflare preview ebb52734 reviewed on desktop and 320px mobile for all five affected guides, canonical URLs, search and HTTP 404; preview remains noindex. Production deployment 757fcec6 at merge commit 7d1a7b6 is verified on the canonical domain, including all five guides, 320px layout, search, HTTP 404 and the Go 1.27.2 development minimum.

Compatibility: no schema migration, new runtime configuration or scanner/Compose/release-pipeline change. Existing saved-job editing, profile revisions, API creation defaults and baseline decisions remain authoritative. Intended release: v0.32.0, using the unchanged immutable candidate and runtime smoke workflow.

[cloudflare-workers-and-pages]

Deploying edgewatch with    Cloudflare Pages

Latest commit:	3980156
Status:	✅  Deploy successful!
Preview URL:	https://ebb52734.edgewatch-cpd.pages.dev
Branch Preview URL:	https://feat-guided-monitor-setup.edgewatch-cpd.pages.dev

View logs