The versioned analytics surface

A separate, explicitly versioned path exists for customer analytics
integrations:

/api/bng/analytics/v1/*                                admin_only

This is the only versioned path prefix in the system, and the version marks
exactly where the customer-facing compatibility boundary sits. It is backed by
the same query facade as the internal charts, rate-limited per key, and returns a
uniform envelope carrying the series, the resolved range, the answering source,
and an as_of anchor. Step floors are enforced per range and a request for a
finer step than the floor is rejected with 400 — that is the cost guard.

A PromQL passthrough exists alongside it, forwarding verbatim to the
Prometheus HTTP API. It is feature-flagged and off by default, requires an API
key rather than a browser session (so a third-party page cannot issue queries
through a live operator session), and requires admin_only plus a dedicated key
scope. When the flag is off it returns 404, not 403, so an unauthenticated
probe cannot confirm the feature exists.

The two surfaces have deliberately different failure contracts. If Prometheus is
down, the curated endpoint falls back to the sampler and reports
source: "sampler". The PromQL passthrough returns 502 and does not fall
back — the caller asked for the raw thing, and a substitute would be a lie.

Events

The event subsystem exists because a raw sensor state is not an operational
signal. A fan that dropped below threshold at 03:00 and recovered at 03:04 is
invisible to any endpoint that reports current state, and an operator who stepped
away misses the entire incident. QuantumTouch therefore models events in three
cleanly separated layers.