feature(api) + feature(marketing-ui) + test(e2e): the app store product page — detail endpoint, reviews with comments, card → page wiring (D50)

[jacoby149]

What

The app store's product page is real (D50, the build). Tap a tile → a shareable page with the full manifest description, the complete metric breakdown, and reviews (rating + optional comment). Logged-in users can rate and comment directly on the page.

Builds on the D50 spec (PR #682, app-store/endpoints.md) — this branch is a superset of it, so the diff shows the docs until #682 merges.

Operator: "opening the app store logged in, they should be able to rate, comment."

API

• GET /v3/apps/detail?url= — the product page payload in one public read: app record + full realtime metric breakdown (get_app_metrics over app_visits) + rating aggregate + rating list + the /v3/stats node macro. 404 for unknown and unapproved apps. Pure read — a product-page view writes no app_visits row.
• app_ratings gains comment String DEFAULT '' (DDL template + boot-time ALTER, named-column insert). POST /v3/apps/rating accepts an optional comment (1000-char cap); the rating list + detail return it. Ratings key on the canonical url (hardening dramatically reorganized the crm #4).
• Dedup fix the e2e caught: a re-rate appends a new row; a plain deleted = 0 read sees both until a background ReplacingMergeTree merge. Fixed with the house dedup-then-filter pattern (row_number() OVER (PARTITION BY target_app_id, author ORDER BY updated_at DESC, deleted DESC)) in get_app_ratings and the admin aggregate (same latent bug).
• list_store_apps stops blanking web10apps_post_id (field dropped — the URL is the key).

UI (marketing-ui)

• Card links to /app-store/app/{urlencoded-canonical-url}, preserving the ?api= override for isolated stacks.
• AppDetail rewritten: the detail endpoint replaces the phantom PATCH /discover/app/{id}; the PWA manifest is preferred for identity; five metric blocks; reviews (aggregate + list + comments + designed empty state); the rate form is session-gated on the token cookie — signed in → star picker + comment + submit; signed out → "Sign in to rate" card that loads the SDK IIFE on demand and runs the D42 auth popup. Node context footer.

Tests

• 12 new API unit tests (detail composition / 404 unknown / 404 unapproved / pure-read / url normalization; comment round-trip / named-column insert / cap; ratings dedup read) + 3 stale get_app mocks re-aligned to the new created_at column.
• AppDetail.test.tsx rewritten (17 tests); AppCard route tests re-aligned to the URL-encoded key.
• 4 new e2e tests in app-store.spec.ts (detail payload + pure-read, 404s, rating round-trip with re-rate dedup + cap, card → product page browser seam).

Verification

• 725 API tests green, ruff clean
• 213 marketing-ui tests green, tsc + build clean
• e2e app-store 13/13 + marketing-ui 4/4 green against an isolated stack (E2E_HTTP_PORT=8091, real ClickHouse — the dedup bug only reproduces there)
• Screenshots captured (desktop + 375px, product page + store)

KB

endpoints.md logistics table updated to built; CHANGELOG 3.17.0; plan + lane ticks.