feat(api): CL0UD capability probe + a11y/HAR evidence + worker scale toggle

- cl0ud client: contract-first probe of documented GET /capabilities/:id,
  status connected/denied/unavailable/disabled surfaced in /health;
  CL0UD_REQUIRED=true = fail-closed 503; full policy-decisions gated on
  CL0UD B-4/ADR-0031 (deliberately not simulated)
- capture depth: accessibility tree + condensed HAR as evidence kinds
  (null = explicit evidence gap)
- CAPTURE_WORKER=on/off for separate-scale deployments
- 34/34 tests

apps/api/tests/cl0ud.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect, vi } from "vitest";
+import { createCl0udClient } from "../src/cl0ud/client.js";
+
+function okFetch(body: Record<string, unknown>) {
+  return vi.fn().mockResolvedValue(new Response(JSON.stringify(body), { status: 200 }));
+}
+
+describe("cl0ud client", () => {
+  it("disabled without baseUrl", async () => {
+    const client = createCl0udClient({});
+    const p = await client.probe();
+    expect(p.status).toBe("disabled");
+    expect(client.status.checkedAt).toBeTruthy();
+  });
+
+  it("connected when all capabilities ACTIVE", async () => {
+    const fetchImpl = okFetch({ id: "c0py.capture.run.v1", status: "ACTIVE" });
+    const client = createCl0udClient({
+      baseUrl: "https://cl0ud.example",
+      capabilityIds: ["c0py.capture.run.v1"],
+      fetchImpl: fetchImpl as unknown as typeof fetch,
+    });
+    const p = await client.probe();
+    expect(p.status).toBe("connected");
+    expect(p.capabilities["c0py.capture.run.v1"]).toBe("ACTIVE");
+    expect(fetchImpl).toHaveBeenCalledWith(
+      "https://cl0ud.example/capabilities/c0py.capture.run.v1",
+      expect.anything(),
+    );
+  });
+
+  it("unavailable when unreachable", async () => {
+    const fetchImpl = vi.fn().mockRejectedValue(new Error("down"));
+    const client = createCl0udClient({
+      baseUrl: "https://cl0ud.example",
+      capabilityIds: ["c0py.capture.run.v1"],
+      fetchImpl: fetchImpl as unknown as typeof fetch,
+    });
+    expect((await client.probe()).status).toBe("unavailable");
+  });
+
+  it("denied when capability present but not ACTIVE", async () => {
+    const client = createCl0udClient({
+      baseUrl: "https://cl0ud.example",
+      capabilityIds: ["c0py.capture.run.v1"],
+      fetchImpl: okFetch({ id: "c0py.capture.run.v1", status: "DEPRECATED" }) as unknown as typeof fetch,
+    });
+    expect((await client.probe()).status).toBe("denied");
+  });
+});