feat: allowlist tests, migration split, freshness memoization, sidebar widget collapse

[wheval]

This PR addresses four issues in one changeset. Each area is self-contained and independently tested.

Closes #970
Closes #971
Closes #972
Closes #973

#970 — test: unit tests for ProviderAllowlist service

Adds backend/tests/services/providerAllowlist.service.test.ts with focused coverage of allow, deny, and edge cases (empty/duplicate entries, case handling, cache refresh, and audit/logging side effects) using an in-memory knex fake and mocked audit + logger dependencies. No production code changes.

#971 — refactor: modularize schema migrations under migrations/

Splits the single 038_metrics_aggregation_pipeline.ts migration (which created three independent tables) into one timestamped migration per table, following the repo's migrate:make naming convention:

• metric_data_points
• metric_rollups
• metric_retention_policies (retains the retention-policy seed)

Column definitions, indexes, and seed data are preserved exactly. migrate:validate reports all migration files OK.

#972 — fix: infinite re-render in useFreshness hook

Introduces a memoized composite useFreshness hook whose returned object keeps a stable identity across renders: derived values are computed with useMemo, refetch is wrapped in useCallback, and empty collections reuse module-level constants so identity is stable while loading. FreshnessMonitoring is updated to consume the composite hook and to memoize the targets arrays it forwards into useRefreshControls/RefreshControls, removing the unstable array-literal churn that fed the re-render loop. Adds a referential-stability regression test.

#973 — feat: collapse Metrics Sidebar widgets

Adds per-widget collapse to the Metrics Sidebar. The store tracks a persisted collapsedIds list with a toggleWidgetCollapse(id) action (cleaned up on unpin); each PinnedMetricCard gains an accessible chevron toggle (aria-expanded, descriptive aria-label) that hides the value/trend/category while keeping the label. New props are optional, so other consumers of the card are unaffected.

Validation

• New backend allowlist tests and frontend hook/store tests pass locally.
• migrate:validate passes.
• Pre-existing type-check/lint/test failures unrelated to these changes remain and were confirmed against the base branch; no new failures were introduced by this PR.

[drips-wave]

@wheval Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits