feat(flightlab): serve bridge telemetry to the website process

FlightLab lives on the website, /api/bridge/data lives here — since the split
those are two processes, and the website's copy of the in-memory store never
fills up again. The new service endpoint lets the website read this process's
store over HTTP, guarded by the SERVICE_SECRET the delete webhook already uses.

Pull, not push: the website asks only while somebody has a FlightLab screen
open, so a running bridge costs nothing when nobody is watching. No user lookup
is needed — the store keys on AppUser._id, which *is* the SSO subject.

Also repairs `yarn test`, which could not start at all in this repo: the split
carried tsconfig.tests.json across but not the tsconfig.scripts.json it extends.
The options are inlined instead, since this repo has no scripts/ directory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/api/service/flightlab-telemetry.get.ts

@@ -0,0 +1,37 @@
+import { createError, defineEventHandler, getQuery } from 'h3'
+import { requireServiceSecret } from '../../utils/serviceAuth'
+import { flightlabTelemetryStore } from '../../utils/flightlabTelemetry'
+
+/**
+ * APP-SIDE. Latest bridge telemetry for one identity, for the website process.
+ *
+ * The bridge posts to /api/bridge/data, which lands in this process's
+ * in-memory store. FlightLab lives on the website and is therefore a different
+ * process since the repo split — it reads the store through this endpoint
+ * instead of importing it.
+ *
+ * Pull, not push: the website asks only while somebody is actually watching a
+ * FlightLab screen, so a running bridge costs nothing when nobody is.
+ *
+ * `subject` is the SSO subject, which is also the key the store uses:
+ * BridgeToken.user references AppUser._id, and AppUser._id *is* the subject
+ * (see server/models/AppUser.ts).
+ *
+ * GET /api/service/flightlab-telemetry?subject=<id>
+ * x-service-secret: <SERVICE_SECRET>
+ */
+export default defineEventHandler((event) => {
+  requireServiceSecret(event)
+
+  const subject = String(getQuery(event).subject || '').trim()
+  if (!subject) {
+    throw createError({ statusCode: 400, statusMessage: 'Missing subject' })
+  }
+
+  const telemetry = flightlabTelemetryStore.get(subject)
+
+  return {
+    telemetry,
+    timestamp: telemetry?.timestamp ?? null,
+  }
+})