fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

web/lib/api/setup-readiness.ts

@@ -1,3 +1,4 @@
+// Modified in AgentDeskFixes: safe, reviewed setup repairs and honest routing diagnostics.
 import { request } from "@/lib/api/client"
 
 export type SetupStepStatus = "ok" | "warning" | "error"
@@ -101,31 +102,51 @@ export type SetupSimulateRouteResponse = {
   candidate_operators: SimulatedOperatorCandidate[]
 }
 
+export type SetupQuickFixChange = {
+  entity_type: string
+  entity_id: number
+  entity_name: string
+  operation: "create" | "update"
+  before: Record<string, unknown> | null
+  after: Record<string, unknown>
+}
+
 export type SetupQuickFixResponse = {
+  applied: boolean
+  preview_token: string
+  changes: SetupQuickFixChange[]
+  warning_codes: string[]
   applied_actions: string[]
-  readiness: SetupReadinessResponse
+  readiness?: SetupReadinessResponse
 }
 
 export function fetchSetupReadiness() {
   return request<SetupReadinessResponse>("/api/dashboard/setup/readiness")
 }
 
-export function simulateSetupRoute(payload: {
+export async function simulateSetupRoute(payload: {
   channel_id?: number
   bypass_ai?: boolean
 }) {
-  return request<SetupSimulateRouteResponse>(
+  const result = await request<SetupSimulateRouteResponse>(
     "/api/dashboard/setup/simulate_route",
     {
       method: "POST",
       body: JSON.stringify(payload),
     },
   )
+  return {
+    ...result,
+    hops: result.hops ?? [],
+    candidate_operators: result.candidate_operators ?? [],
+  }
 }
 
 export function applySetupQuickFix(payload: {
   action: SetupQuickFixAction
   entity_id?: number
+  apply?: boolean
+  preview_token?: string
 }) {
   return request<SetupQuickFixResponse>("/api/dashboard/setup/quick_fix", {
     method: "POST",