feat(analysis): NodeInfo Enrichment report under Analysis & Reports (#3837 Phase 2) (#4289)

* refactor(nodes): extract shared NodeInfo field labels for enrichment report (#3837 WP-1)

Extract CopyNodeInfoModal's local DISPLAY_FIELDS label map into a shared
src/utils/nodeInfoFields.ts module (NODE_INFO_DISPLAY_FIELDS,
NODE_INFO_FIELD_LABELS, nodeInfoFieldLabel, NodeInfoFieldKey) so the
upcoming NodeInfo Enrichment report and the modal share one source of
truth. The modal imports the list aliased as DISPLAY_FIELDS — zero
behavior or rendering change.

Also add the additive enrichment-report CSS (.reports-enrichment__push,
.reports-field-pill) to src/styles/analysis-reports.css for WP-2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018e4dtLyWeYJYJ7SbgFvGG1

* feat(analysis): NodeInfo Enrichment report + AnalysisTab registration (#3837 Phase 2 WP-2)

Adds the frontend report component that consumes Phase 1's
GET/POST /api/nodes/enrichment/{analysis,apply} endpoints: flattens
(node,target) pairs into table rows, per-row Fix + Fix All via one
mutation, a push-to-NodeDB toggle (default off), and loading/error/empty/
populated states. Registers the card in AnalysisTab's reports grid.

Also commits the Phase 2 spec doc (was untracked in the worktree).

* docs: document NodeInfo Enrichment report on Analysis & Reports page

Adds a NodeInfo Enrichment section (#3837) alongside Solar Monitoring
on the Analysis & Reports page, covering what gets analyzed, the
fill-blanks-only Fix/Fix All apply model, the push-to-device toggle,
and per-endpoint permissions and error codes.

* docs: mark epic Phase 2 implementation complete with deviations (#3837)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018e4dtLyWeYJYJ7SbgFvGG1

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Yeraze

docs/features/analysis-reports.md

@@ -2,7 +2,7 @@
 
 The **Analysis & Reports** workspace is a global, cross-source analytics page that runs analytical reports against the telemetry, position, and routing data MeshMonitor has collected from every source you can read. It lives at `/reports` and is linked from the bottom of the dashboard sidebar (right under *Map Analysis*).
 
-The first report bundled with the workspace is **Solar Monitoring Analysis** — see below. The card-grid landing page is designed to host additional reports over time without changing the routing or navigation surface.
+Two reports are currently bundled with the workspace: **Solar Monitoring Analysis** and **NodeInfo Enrichment** — see below. The card-grid landing page is designed to host additional reports over time without changing the routing or navigation surface.
 
 ## Solar Monitoring Analysis
 
@@ -60,25 +60,72 @@ Nodes whose simulated minimum drops below `50%` (battery) or `3.5 V` (voltage) a
 
 Solar production must already be configured under **Settings → Solar Monitoring** for the forecast to produce useful output. See the [Solar Monitoring guide](./solar-monitoring) for set-up details.
 
+## NodeInfo Enrichment
+
+Scans every node visible on more than one source for blank NodeInfo fields — Long Name, Short Name, Hardware Model, Role, MAC Address, Public Key, Firmware — that another source's record for the same physical node can fill, and lets you copy the missing data across sources. It generalizes the per-node "Copy NodeInfo" dialog (available from the node detail panel) into a batch view spanning every source you can read.
+
+### What gets analyzed
+
+For every node seen on two or more of your permitted sources, the report checks the fields above for blanks. Each row in the report table is one **(node, target source)** pair — a specific source's record for a specific node that is missing at least one field — and lists:
+
+- The **fillable fields** for that row (only the ones actually blank on the target and present on the donor)
+- The **donor source**: whichever other source holds the most complete record for that node. Completeness is ranked by number of non-blank fields, with the most recently updated record winning ties.
+
+### Running the report
+
+1. Open the dashboard, click **Analysis & Reports** in the sidebar.
+2. Click the **NodeInfo Enrichment** card.
+3. Review the summary tiles — **Nodes**, **Targets**, **Fillable fields** — above the table.
+4. Click **Fix** on a row to apply just that (node, target source) pair, or **Fix All** to apply every row currently listed.
+5. Click **Refresh** to re-run the analysis, e.g. after applying fixes or after new NodeInfo has arrived over the mesh.
+
+### Applying fixes
+
+Applying a row is **fill-blanks-only**: it writes only the fields that are currently empty on the target source's record and never overwrites a field that already has a value — even if the analysis backing the row has gone stale since the page loaded. This makes Fix and Fix All safe to click at any time.
+
+An **Also push to device NodeDB** toggle (default off) sits above the table. When enabled, each node that gets enriched also receives the same NodeInfo-exchange nudge as the manual Copy NodeInfo dialog's push option (`sendNodeInfoRequest` on the node's channel). This generates mesh traffic, so leave it off if you only want to update MeshMonitor's own database.
+
+Because a row reflects only its single best donor, fixing it can uncover further blanks: if that donor didn't have every missing field, the row disappears but the node may resurface with a different (partial) donor on the next analysis. Click **Refresh** (or re-run the report) until the table drains to fully converge a node across all sources.
+
+> **On-demand only.** This report has no background scheduler — it runs interactively whenever you open the card or click Refresh/Fix.
+
 ## Permissions
 
-Both endpoints behind the workspace are scoped to the requesting user's permitted source IDs:
+### Solar Monitoring
+
+Both solar endpoints are scoped to the requesting user's permitted source IDs:
 
 - Admins see all enabled sources
 - Non-admin users see sources where they hold `nodes:read`
 - An optional `?sources=id1,id2` query param restricts the analysis further (intersected with permitted IDs)
 
-The page itself is publicly routable; only the data is gated.
+### NodeInfo Enrichment
+
+- **Analysis** (`GET /api/nodes/enrichment/analysis`) only ever computes over sources the caller holds `nodes:read` on — admins see every source, anonymous/unauthenticated callers see none (an empty, but never a `403`, response).
+- **Applying** (`POST /api/nodes/enrichment/apply`) requires `nodes:read` on the donor source and `nodes:write` on every target source referenced by the request. A single missing grant rejects the whole batch with `403 FORBIDDEN` — partial application of an under-permissioned batch never happens.
+
+The page itself is publicly routable for both reports; only the underlying data is gated.
 
 ## API
 
-The Reports workspace surfaces two endpoints under the existing `/api/analysis/*` namespace:
+### Solar Monitoring
+
+Two endpoints under the existing `/api/analysis/*` namespace:
 
 - `GET /api/analysis/solar-nodes?lookback_days=N&sources=…`
 - `GET /api/analysis/solar-forecast?lookback_days=N&sources=…`
 
 See the [REST API reference](https://github.com/Yeraze/meshmonitor/blob/main/docs/api/REST_API.md) for the full request/response shapes.
 
+### NodeInfo Enrichment
+
+Two endpoints under `/api/nodes/enrichment/*` (also mirrored at `/api/v1/nodes/enrichment/*`), using the standard `{ success, data }` response envelope:
+
+- `GET /api/nodes/enrichment/analysis` — returns `{ nodes: [...], summary: { nodeCount, targetCount, fieldCount } }`.
+- `POST /api/nodes/enrichment/apply` — body `{ items: [{ nodeNum, targetSourceId, donorSourceId }], pushToNodeDb? }`, returns `{ applied: [...], totalFieldsCopied }`.
+
+Error codes: `INVALID_REQUEST` / `INVALID_ITEM` (400, malformed request body), `FORBIDDEN` (403, missing `nodes:read`/`nodes:write` — includes a `missing` list), `ENRICHMENT_ANALYSIS_FAILED` / `ENRICHMENT_APPLY_FAILED` (500).
+
 ## Related
 
 - [Solar Monitoring](./solar-monitoring) — configuration of the forecast.solar integration that powers the production curve and forecast factor

docs/internal/dev-notes/NODEINFO_ENRICHMENT_EPIC.md

@@ -58,19 +58,31 @@ apply the enrichment ("Fix") per node or in bulk.
 ### Phase 2 — Frontend: Analysis & Reports card
 **Branch:** `feature/nodeinfo-enrichment-report`
 
-- [ ] Extend `AnalysisType` + `reports[]` with a "NodeInfo Enrichment" card; new
+- [x] Extend `AnalysisType` + `reports[]` with a "NodeInfo Enrichment" card; new
       `src/components/Analysis/NodeInfoEnrichmentReport.tsx` (TanStack useQuery +
       `ApiService` — raw fetch is banned in new components; `UiIcon` for icons).
-- [ ] Table of enrichable nodes (node, target source(s), missing fields, donor source),
+- [x] Table of enrichable nodes (node, target source(s), missing fields, donor source),
       per-row **Fix** + **Fix All**, push-to-NodeDB toggle default off, empty/loading/
       unauthorized states.
-- [ ] Component tests; browser validation in the dev container (screenshots, console
+- [x] Component tests; browser validation in the dev container (screenshots, console
       clean, gauntlet-channel only for any test traffic).
 - **Exit criteria:** report usable end-to-end against the dev container; suite green;
   PR merged to main; issue #3837 closed.
 
 ## Deviations / notes
 
+- Phase 2: a row's `fillableFields` reflect its single best donor, so fixing a row can
+  surface remaining blanks under a different donor on the next analysis (observed live:
+  fill Firmware from Sandbox → MAC Address appears with donor Florida MQTT). By design;
+  documented in the feature doc ("run again until the list drains").
+- Phase 2: shared field-label map extracted to `src/utils/nodeInfoFields.ts`;
+  `CopyNodeInfoModal` refactored to consume it (zero behavior change).
+- Phase 2: anonymous users see a non-empty analysis when the anonymous account holds
+  `nodes:read` grants (validated live: read-narrowed analysis + apply 403 fail-closed
+  with `missing` list). The empty-state hint covers the no-grants case.
+- Phase 2: component test uses a file-local `react-i18next` mock (the global test setup
+  mocks the 2-arg `t()` form; the component uses the 3-arg default-value form).
+
 - Phase 1: apply endpoint takes an explicit `items` list
   (`{nodeNum, targetSourceId, donorSourceId}[]`) so Phase 2's per-row Fix and
   Fix All share one endpoint; fill-blanks-only is enforced by delegating to