Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

Phase 4 (migration 053): pull entry/denied events into door_access_log and
match each card to a member, via two transports sharing one ingest core.
Poll: a CRON_SECRET-guarded /api/cron/door-ingest reads each opted-in
native-HeatSync connection's ?z log through the existing hardened executor
and parses it (firmware-characterized, best-effort ring buffer). Webhook:
/api/door/inbound/[connection] accepts pushed event JSON authenticated by a
per-connection bearer secret from the vault. Both dedupe on
(connection_id, dedupe_key) so re-polls and retries are no-ops. Adds an
inbound config panel to /door/manage.

Phase 5 (migration 054): admins define api_buttons that fire a configured
HTTP call (full verbs + headers + body) when an authorized member presses
them, through the same hardened egress (now shared between callDoor and the
new callApi). Each button carries a required_permission (default the new
apicall.invoke code); members see only buttons they may press. Builder at
/door/buttons with a door-template preset; members press from /doors. Every
press is recorded in api_call_log with secrets redacted.

Both subsystems are inert until an admin enables inbound on a connection or
creates a button. 624 unit + 50 integration tests; migrations applied
top-to-bottom in schema.sql; types and docs updated.

app/api/cron/door-ingest/route.ts

@@ -0,0 +1,80 @@
+// Door inbound-log poll. Hit once a minute by the droplet's crontab (see
+// docs/DEPLOYMENT.md) to pull access events from each native-HeatSync
+// connection that has opted into inbound ingest. Unauthenticated by session
+// (cron has none); proxy.ts whitelists this exact path and trust is the
+// CRON_SECRET shared secret, compared in constant time.
+//
+// Each connection's `?z` log is read through the SAME hardened executor as the
+// outbound actions (SSRF host pin, no redirects, time/body caps, secret
+// redaction). Parsed events are resolved to members and idempotently inserted
+// (dedupe_key + ON-CONFLICT no-op), so overlapping runs and unchanged re-polls
+// are safe. Generic controllers ingest via the per-connection webhook instead;
+// only native_heatsync has a characterized log format to parse.
+import { NextRequest, NextResponse } from 'next/server'
+import { timingSafeEqual } from 'node:crypto'
+import { createAdminClient } from '@/lib/supabase/admin'
+import { pollConnectionLog, ingestEvents, type IngestConn } from '@/lib/door/ingest'
+
+export const runtime = 'nodejs'
+export const dynamic = 'force-dynamic'
+
+// Bounded work per run: cap the connections polled so a misconfigured fleet
+// cannot make one cron tick run unbounded. A single hackerspace has one or two
+// doors, so this is generous.
+const MAX_CONNECTIONS = 50
+
+function authorized(req: NextRequest): boolean {
+  const expected = process.env.CRON_SECRET
+  if (!expected) return false
+  const header = req.headers.get('authorization') ?? ''
+  const provided = header.startsWith('Bearer ') ? header.slice(7) : header
+  const a = Buffer.from(provided)
+  const b = Buffer.from(expected)
+  return a.length === b.length && timingSafeEqual(a, b)
+}
+
+export async function POST(req: NextRequest) {
+  if (!process.env.CRON_SECRET) {
+    return NextResponse.json({ error: 'CRON_SECRET not configured' }, { status: 503 })
+  }
+  if (!authorized(req)) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const admin = createAdminClient()
+  const { data: conns, error } = await admin
+    .from('door_connections')
+    .select('id, space_id, adapter, base_url, pinned_host, auth_param, secret_ref, verbs, is_enabled')
+    .eq('is_enabled', true)
+    .eq('inbound_enabled', true)
+    .eq('adapter', 'native_heatsync')
+    .order('created_at', { ascending: true })
+    .limit(MAX_CONNECTIONS)
+  if (error) return NextResponse.json({ error: error.message }, { status: 500 })
+
+  let polled = 0
+  let inserted = 0
+  let resolved = 0
+  let failed = 0
+  for (const c of (conns ?? []) as unknown as IngestConn[]) {
+    polled++
+    // Isolate each connection: a single misbehaving controller (the body is
+    // untrusted, plaintext HTTP) must not 500 the whole run and starve the rest.
+    try {
+      const poll = await pollConnectionLog(admin, c)
+      if (!poll.ok) {
+        failed++
+        console.error(`[door-ingest] connection ${c.id}: ${poll.detail}`)
+        continue
+      }
+      const res = await ingestEvents(admin, c.space_id, c.id, poll.events)
+      inserted += res.inserted
+      resolved += res.resolved
+    } catch (e) {
+      failed++
+      console.error(`[door-ingest] connection ${c.id} threw:`, e instanceof Error ? e.message : e)
+    }
+  }
+
+  return NextResponse.json({ ok: true, polled, inserted, resolved, failed })
+}