docs(spec): correct SPEC-022 summary route; note SPEC-014 lazy-import is not a bug

SPEC-022 listed /api/v1/threat-intel/summary, which has no implementation and no
UI consumer; the real aggregate route is /feeds/summary -- corrected the spec
rather than build a dead endpoint. SPEC-014's verify_api_key lazy-import from
apps.api.app is correct (the app is always loaded before requests; the None
fallback only affects isolated tests and is fail-closed) -- left unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: DevOpsMadDog

docs/ralph_progress.md

@@ -562,3 +562,5 @@ tick273 (2026-06-25, ralph-c4) — NPM DEPENDABOT: npm audit (UI) found 8 vulns
 tick274 (2026-06-25, ralph-c4) — ALL repo dependency trees -> 0 vulns: audited the 3 remaining tracked lockfiles. root package-lock (2 vulns: 1 high/1 mod) -> 0 via safe npm audit fix. ide-plugins/vscode (9 vulns: 3 high/6 mod) -> 0 via npm audit fix + --force @vscode/vsce 3.9.2 (dev packaging tool, NOT deployed; tsc compile clean exit 0). sdks/typescript already 0. Neither root nor vscode is in the deployed image (deployed = requirements.txt + suite-ui/aldeci-ui-new build), so no redeploy needed. NET across the session: every tracked dep tree (Python core cryptography48 + suite-ui-new 8->0 + root 2->0 + vscode 9->0 + sdks 0) = 0 known vulns. The GitHub "251" residue beyond this needs gh auth (legacy/dismissed alerts).
 
 tick275 (2026-06-26, ralph-c4) — GAP_MAP med (SPEC-025) forensics stats field mismatch: DigitalForensicsPanel.tsx reads stats.total_cases/closed_cases/critical_cases but engine get_forensics_stats only returned open_cases (UI silently fell back to client-side list counting -> not the real DB aggregate, and critical badge never showed). Added 3 COUNT queries (total_cases, closed_cases, critical_cases by priority) to the engine return. Verified: all 7 keys present, honest-empty zeros for a fresh org, 29 forensics tests pass. UI primary stats path now wired to real DB aggregates.
+
+tick276 (2026-06-26, ralph-c4) — GAP_MAP med triage (2 items, doc-only): (1) SPEC-022 /threat-intel/summary listed in spec but route does not exist (only /feeds/summary) AND no UI consumer -> building it = dead weight (feedback_check_ui_before_backend_wire); corrected the SPEC to the real /feeds/summary route instead. (2) SPEC-014 verify_api_key lazy-imports rate-limit/audit/decode from apps.api.app at call time -> VERIFIED NOT A BUG: in production apps.api.app is always in sys.modules before any request (it IS the app), so the functions bind; the None else-branch only affects isolated unit tests and is fail-closed for auth. Working code, left unchanged. No prod code touched this tick.

specs/SPEC-022-threat-intel.md

@@ -23,7 +23,7 @@ Brain Pipeline + TrustGraph correlation. See memory: intelligence-layer ingest-f
 | GET | /api/v1/threat-intel/cves/recent | recently-cached CVEs (EPSS-enriched) | api_key | yes |
 | GET | /api/v1/threat-intel/iocs | IOC list `{total, iocs[], offset, limit}` | api_key | yes |
 | GET | /api/v1/threat-intel/kev | CISA KEV catalog (cached) | api_key | yes |
-| GET | /api/v1/threat-intel/summary | aggregate TI summary | api_key | yes |
+| GET | /api/v1/threat-intel/feeds/summary | aggregate feed/IOC summary (real route; was mis-documented as `/threat-intel/summary`, which has no implementation or UI consumer) | api_key | yes |
 | GET | /api/v1/feeds/status | feed-manager health + total_feeds | api_key | n/a |
 | GET | /api/v1/feeds/nvd/recent | recent NVD CVEs `{cves[], count, severity_filter}` | api_key | yes |
 | GET | /api/v1/ioc-enrichment/ · /stats | IOC stats `{total, by_type, by_severity, enriched_count, watchlist_count}` | api_key | yes |