fix(webui): resolve PR #856 conflicts with master after #838 inventory merge (#646)

Keep both policy-visibility and inventory-api imports/routes after master
landed #838. Conflict was import-only in webui/app.py.

Closes conflict remediation for PR #856 / issue #646.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/app.py

@@ -48,6 +48,11 @@ from webui.runtime_health import load_runtime_snapshot, snapshot_to_dict as runt
 from webui.runtime_views import render_runtime_page
 from webui.policy_inventory import load_policy_inventory, snapshot_to_dict as policy_snapshot_to_dict
 from webui.policy_views import render_policy_page
+from webui.inventory import (
+    SECTION_NAMES as _INVENTORY_SECTIONS,
+    load_inventory_snapshot,
+    snapshot_to_dict as inventory_snapshot_to_dict,
+)
 from webui.timeline import load_timeline, snapshot_to_dict as timeline_snapshot_to_dict
 from webui.analytics_loader import (
     load_analytics,
@@ -479,6 +484,30 @@ async def api_action_attempt(request: Request) -> JSONResponse:
     return JSONResponse(result, status_code=status)
 
 
+async def api_inventory(_request: Request) -> JSONResponse:
+    """Unified read-only session/lease/lock/worktree inventory (#636)."""
+    snapshot = load_inventory_snapshot()
+    return JSONResponse(inventory_snapshot_to_dict(snapshot))
+
+
+async def api_inventory_section(request: Request) -> JSONResponse:
+    """Resource-split view: one inventory section under the shared schema."""
+    section = request.path_params["section"]
+    if section not in _INVENTORY_SECTIONS:
+        return JSONResponse(
+            {
+                "error": "unknown_section",
+                "detail": f"no inventory section named {section!r}",
+                "available": sorted(_INVENTORY_SECTIONS),
+            },
+            status_code=404,
+        )
+    snapshot = load_inventory_snapshot(include=(section,))
+    payload = inventory_snapshot_to_dict(snapshot)
+    payload["requested_section"] = section
+    return JSONResponse(payload)
+
+
 async def api_console_security_model(_request: Request) -> JSONResponse:
     """Read-only publication of the #633 authorization/redaction/audit model."""
     return JSONResponse({
@@ -759,6 +788,12 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
                 methods=["POST"],
             ),
             Route("/api/leases", api_leases, methods=["GET"]),
+            Route("/api/v1/inventory", api_inventory, methods=["GET"]),
+            Route(
+                "/api/v1/inventory/{section}",
+                api_inventory_section,
+                methods=["GET"],
+            ),
             Route(
                 "/api/console/security-model",
                 api_console_security_model,