fix(web): scope dashboard tile hydration

apps/web/src/server/routes/dashboard.test.ts

@@ -113,6 +113,65 @@ describe("dashboard API route", () => {
       expect.objectContaining({ cache: "no-store" }),
     );
   });
+
+  test("hydrates a service tile with its service group identity", async () => {
+    const fetch = vi.fn(async () =>
+      jsonResponse({
+        status: "UP",
+        ping: 42,
+      }),
+    );
+
+    const response = await loadDashboardTileResponse(
+      { kind: "service", groupId: "essentials", id: "vaultwarden" },
+      {
+        fetch,
+        refreshSeedDocument: true,
+        seedIfEmpty: true,
+      },
+    );
+
+    expect(response.state).toBe("ready");
+    if (response.state !== "ready") throw new Error("expected ready tile");
+    expect(response.tile).toEqual({
+      kind: "service",
+      groupId: "essentials",
+      id: "vaultwarden",
+    });
+    expect(response.item).toMatchObject({
+      id: "vaultwarden",
+      severity: "ok",
+      detail: "42 ms",
+    });
+  });
+
+  test("does not hydrate tile routes when live datasources are disabled", async () => {
+    const previous = process.env.DISABLE_LIVE_DATASOURCES;
+    process.env.DISABLE_LIVE_DATASOURCES = "1";
+    const fetch = vi.spyOn(globalThis, "fetch").mockRejectedValue(
+      new Error("live datasource fetch should not run when disabled"),
+    );
+
+    try {
+      const response = await loadDashboardTileResponse(
+        { kind: "telemetry", id: "infra-ram" },
+        {
+          refreshSeedDocument: true,
+          seedIfEmpty: true,
+        },
+      );
+
+      expect(response.state).toBe("disabled");
+      expect(fetch).not.toHaveBeenCalled();
+    } finally {
+      fetch.mockRestore();
+      if (previous === undefined) {
+        delete process.env.DISABLE_LIVE_DATASOURCES;
+      } else {
+        process.env.DISABLE_LIVE_DATASOURCES = previous;
+      }
+    }
+  });
 });
 
 function jsonResponse(payload: unknown): Response {

apps/web/src/server/routes/dashboard.ts

@@ -63,6 +63,17 @@ export async function loadDashboardTileResponse(
   tile: DashboardTileReference,
   options: LoadDashboardResponseOptions = {},
 ): Promise<DashboardTileResolution> {
+  if (
+    options.disableLiveDatasources ||
+    process.env.DISABLE_LIVE_DATASOURCES === "1"
+  ) {
+    return {
+      state: "disabled",
+      tile,
+      message: "Live datasource hydration is disabled.",
+    };
+  }
+
   const dashboard = loadDashboardRuntime(undefined, {
     refreshSeedDocument: options.refreshSeedDocument ?? true,
     seedIfEmpty: options.seedIfEmpty ?? true,
@@ -95,7 +106,7 @@ export async function handleDashboardTileRoute(pathname: string): Promise<Respon
 
   const response = await loadDashboardTileResponse(tile);
   return Response.json(response, {
-    status: response.state === "ready" ? 200 : 404,
+    status: response.state === "not_found" ? 404 : 200,
   });
 }
 
@@ -107,10 +118,18 @@ function parseDashboardTilePath(pathname: string): DashboardTileReference | null
   }
 
   const id = decodeURIComponent(firstId);
-  if (kind === "telemetry" || kind === "service" || kind === "module") {
+  if (kind === "telemetry" || kind === "module") {
     return { kind, id };
   }
 
+  if (kind === "service" && secondId) {
+    return {
+      kind,
+      groupId: id,
+      id: decodeURIComponent(secondId),
+    };
+  }
+
   if (kind === "status" && secondId) {
     return {
       kind,