onu detail: parent OLT + LLDP switch + traffic history + alarms + UNI; single-ONU upgrade

De-compacts the ONU info page into a responsive card grid and enriches it
with one new endpoint (api:getOnuDetail) summarized by the pure, shared
src/onudetail.js:
- Parent OLT (name/model/FW/PON) — follows the OLT MAC from the ONU
  alarm-history doc to its OLT-CFG.
- Upstream switch (LLDP neighbour of the OLT NNI) from the alarm-history
  Switch block: system name, port, IPv4, chassis.
- Traffic (last ~hour) with current + peak down/up and inline SVG
  sparklines, from /onus/stats/ (down = OLT TX rate, up = OLT RX rate).
- UNI-ETH ports (speed/duplex/enable) + last Ethernet LOS (LAN-LOS alarm).
- Alarms: active-first, severity-sorted with raised counts + last raised.
- CPE card folded into the same single fetch.

New client methods getOnuAlarms + getOnuStatsSeries; api:getOnuDetail in
main.js + web/server.js, exposed in both bridges. Not TTL-cached (live).

Single-ONU upgrade: the Firmware card gets a firmware picker + "Upgrade this
ONU" button reusing the bulk per-ONU path (executePerOnu with one id,
Procedure 7 inactive-bank write), behind a typed UPGRADE confirm; refreshes
the detail on success.

Docs: CLAUDE.md §17 + §5.11 (stats endpoint now used for the sparkline) +
IPC table.

Verified: node --check; onudetail.js unit-tested 11/11 against the real
alarm-history / cfg / stats / OLT-cfg fixtures (firmware banks, UNI, alarm
sort, LAN-LOS, OLT active-bank FW, LLDP switch, traffic skip-nontraffic +
down/up mapping + current/peak); card grid rendered offscreen (9 cards, 2
sparklines, upgrade button).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -120,6 +120,7 @@ stream progress events back to the renderer.
 | `api:fetchStates` | per-ONU state fallback if bulk failed | `states:progress` |
 | `api:listOnuConfigs` / `api:getOnuConfig` | direct CFG access | — |
 | `api:getOnuCpe` | CPE (router) DHCP lease health + OUI vendor | — |
+| `api:getOnuDetail` | rich ONU detail: firmware/UNI/alarms/OLT/switch/traffic/CPE | — |
 | `api:listOnuFirmware` / `api:uploadFirmware` | firmware inventory | — |
 | `api:planUpgrade` | dry-run plan for selected ONUs | — |
 | `api:executePerOnu` | Procedure 7 — per-ONU PUTs | `upgrade:progress` |
@@ -355,8 +356,12 @@ state_collection.STATS["OLT-PON"]["RX Post-FEC BER"]
 
 → The pre-flight fetch (`api:fetchFecHealth`) and the verify fetch
 (`api:fetchOnuSnapshot`) both call `getOnuState(id)` and extract via
-`extractOnuHealth`. The time-series stats endpoint is **not used**
-anywhere — earlier code that hit it has been removed.
+`extractOnuHealth`. For *current* FEC/optical, prefer ONU-STATE.
+
+The time-series endpoint **is** used, but only for the ONU detail page's
+traffic sparkline (`getOnuStatsSeries` → `api:getOnuDetail`, §17): it pulls
+the last ~hour of samples for the down/up rate history. Don't use it for the
+live FEC pill — that stays on ONU-STATE.
 
 `extractOnuHealth` accepts both shapes: the bare state doc
 (`{STATS: ...}`) and the UI-helper wrapped form
@@ -843,9 +848,34 @@ now lands on Info; campaign/verify keep the Fleet sub-tab lit.
 
 Master-detail over the already-loaded `state.fleet` (no new bulk fetch):
 search (name/address/serial) + status filter on the left; clicking an ONU
-renders identity, link/optical (read straight from the merged `_state.STATS`
-via `onuClientStats` — no extra round-trip), firmware, and a **CPE card**.
-Dashboard abnormal-Rx/Tx drill-downs (§15) deep-link here via `openOnuInfo`.
+renders the detail as a **responsive card grid** (`.detail-grid`, auto-fill
+columns — this is the de-compaction). Identity + link/optical paint instantly
+from `state.fleet` (`onuClientStats`); the rest streams from one
+`api:getOnuDetail` call (`src/onudetail.js`, pure, shared):
+
+- **Traffic** — current + peak down/up with inline SVG sparklines, from the
+  `/onus/stats/` time-series (down = OLT TX rate, up = OLT RX rate).
+- **UNI ports** — UNI-ETH config (speed/duplex/enable) + last Ethernet LOS
+  (from the `LAN-LOS` / `PptpEthernetUni` alarm).
+- **Parent OLT** — name/model/FW/PON, resolved by following the OLT MAC in
+  the alarm-history doc to its OLT-CFG.
+- **Upstream switch** — the OLT NNI's LLDP neighbour (`Switch` block on the
+  alarm-history doc): system name, port, IPv4, chassis.
+- **Alarms** — active-first, severity-sorted (`N-LABEL`; rank ≤3 red, 4
+  amber, 5 cyan, ≥6 muted) with raised counts and last-raised.
+- **CPE** (§ above) and **Firmware** (banks + single-ONU upgrade).
+
+`api:getOnuDetail` fans out `getOnuConfig` + `getOnuAlarms` +
+`getOnuStatsSeries` (parallel) → then `getOltConfig(oltMac)` → `getCpe`; it is
+**not** TTL-cached (live detail). Dashboard abnormal-Rx/Tx drill-downs (§15)
+deep-link here via `openOnuInfo`.
+
+### Single-ONU upgrade
+
+The Firmware card has a firmware picker + "Upgrade this ONU" button that
+reuses the bulk per-ONU path — `executePerOnu({ onuIds: [id], … })`
+(Procedure 7, inactive-bank write via `bank-strategy`). Two-step `UPGRADE`
+typed confirm; streams `upgrade:progress`; refreshes the detail on success.
 
 ### CPE (customer router)