feat(webui): AI-provider connections and evidence-backed insights (Closes #650)

Add Phase 4 advisory surfaces for declared AI-provider connection status
(no secrets, no live probe claims) and operational insights derived only
from durable traffic, health, provider, and analytics evidence.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

webui/app.py

@@ -53,6 +53,13 @@ from webui.session_loader import (
     snapshot_to_dict as session_view_snapshot_to_dict,
 )
 from webui.session_views import render_sessions_page
+from webui.insights_loader import (
+    load_insights_snapshot,
+    load_provider_snapshot,
+    snapshot_insights_to_dict,
+    snapshot_providers_to_dict,
+)
+from webui.insights_views import render_insights_page, render_providers_page
 from webui.inventory import (
     SECTION_NAMES as _INVENTORY_SECTIONS,
     load_inventory_snapshot,
@@ -342,6 +349,34 @@ async def api_sessions(_request: Request) -> JSONResponse:
     return JSONResponse(session_view_snapshot_to_dict(load_session_view_snapshot()))
 
 
+async def providers(_request: Request) -> HTMLResponse:
+    """AI-provider connection status (#650) — declared registry only, no secrets."""
+    return HTMLResponse(render_providers_page(load_provider_snapshot()))
+
+
+async def api_v1_providers(_request: Request) -> JSONResponse:
+    """JSON export of declared AI-provider connections (#650)."""
+    snapshot = load_provider_snapshot()
+    return JSONResponse(
+        snapshot_providers_to_dict(snapshot),
+        status_code=200 if snapshot.ok else 502,
+    )
+
+
+async def insights(_request: Request) -> HTMLResponse:
+    """Evidence-backed operational insights (#650) — advisory only."""
+    return HTMLResponse(render_insights_page(load_insights_snapshot()))
+
+
+async def api_v1_insights(_request: Request) -> JSONResponse:
+    """JSON export of evidence-backed insights (#650)."""
+    snapshot = load_insights_snapshot()
+    return JSONResponse(
+        snapshot_insights_to_dict(snapshot),
+        status_code=200 if snapshot.ok else 502,
+    )
+
+
 async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
     if request.method == "GET":
         return "", None
@@ -785,6 +820,10 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/api/sessions", api_sessions, methods=["GET"]),
             Route("/api/v1/sessions", api_sessions, methods=["GET"]),
             Route("/api/v1/timeline", api_v1_timeline, methods=["GET"]),
+            Route("/providers", providers, methods=["GET"]),
+            Route("/api/v1/providers", api_v1_providers, methods=["GET"]),
+            Route("/insights", insights, methods=["GET"]),
+            Route("/api/v1/insights", api_v1_insights, methods=["GET"]),
             Route("/analytics", analytics, methods=["GET"]),
             Route("/api/analytics", api_v1_analytics, methods=["GET"]),
             Route("/api/v1/analytics", api_v1_analytics, methods=["GET"]),