feat(gateway): expose /api/v1/queue on chromebox-gateway and configure Cloudflare ingress

bin/chromebox-gateway.py

@@ -240,8 +240,42 @@ class Handler(BaseHTTPRequestHandler):
         self.wfile.write(body)
 
     def do_GET(self):
-        if urlparse(self.path).path == "/health":
-            self._json(200, {"status": "ok", "ops": sorted(ALLOWLIST)})
+        p = urlparse(self.path).path
+        if p == "/health":
+            self._json(200, {"status": "ok", "ops": sorted(ALLOWLIST), "endpoints": ["/health", "/api/v1/queue", "/api/v1/op"]})
+            return
+        if p == "/api/v1/queue":
+            auth = self.headers.get("Authorization", "")
+            token = auth[7:] if auth.startswith("Bearer ") else ""
+            identity = check_token(token)
+            if not identity:
+                self._json(401, {"error": "unauthorized"})
+                return
+            if not rate_ok(identity):
+                audit({"identity": identity, "op": "queue", "result": "rate_limited"})
+                self._json(429, {"error": "rate_limited"})
+                return
+
+            tasks_dir = os.path.join(os.path.dirname(BIN_DIR), "fleet", "tasks")
+            try:
+                if BIN_DIR not in sys.path:
+                    sys.path.insert(0, BIN_DIR)
+                import runtime_reconcile as rec
+                tasks = rec.list_tasks(tasks_dir)
+                counts = {"pending": 0, "claimed": 0, "done": 0}
+                for t in tasks:
+                    q = t.get("queue")
+                    if q in counts:
+                        counts[q] += 1
+                self._json(200, {
+                    "ok": True,
+                    "tasks": tasks,
+                    "counts": counts,
+                })
+                audit({"identity": identity, "op": "queue", "result": "ok"})
+            except Exception as e:
+                audit({"identity": identity, "op": "queue", "result": "error", "detail": str(e)[:120]})
+                self._json(500, {"ok": False, "error": str(e)})
             return
         self._json(404, {"error": "not_found"})