Restore dashboard, add LICENSE + CI, fix test imports - #1

Summary

The Updated workflow commit (4150bad) deleted all of dashboard/ while leaving dashboard/.vite/deps_temp_*/package.json behind, so the README's quick start (cd dashboard && npm install && npm run dev) pointed at an empty directory. This restores the app from 4150bad^, drops the .vite junk, and adds the missing guardrails that would have caught the regression.

Dashboard — restored as-is except two import bugs that made it unbuildable even before the deletion:

• Layout.jsx imported './hooks/useMQTT' (resolves to src/components/hooks/...) → '../hooks/useMQTT'.
• Two different hooks both lived at src/hooks/useMQTT.{js,jsx}; Vite resolves .js first, so every page got the wrong hook shape ({connected, messages} instead of {status, data}). The .js one is a distinct lower-level client + getMockData, renamed to useMQTTClient.js, and api/client.js updated to import from it. npm run build now succeeds.

Tests — test_behaviour_model.py and test_drift_detector.py both did sys.path.insert(...) + from main import ..., so the second one to import got the first service's cached main module. Added load_service_module() in conftest.py which loads each service's main.py under a unique sys.modules name, plus the runtime deps the service modules pull in (aiomqtt, influxdb-client, apscheduler, ...) to tests/requirements.txt.

Once those two files actually imported, they exposed real bugs in services/automation-agent/main.py, fixed here rather than in the tests:

• record_event assumed an ISO string; a datetime (or a non-ISO MQTT timestamp payload) crashed the message loop. Now accepts either.
• RuleEngine.validate_action did action["device_id"] and system_state["occupancy"].get("occupied"), raising KeyError/AttributeError on any action without a device id or a boolean occupancy — in a safety-check path. Now tolerant, and the HVAC bound also covers the {"action": "set_temperature", "params": {"temperature": ...}} shape used by services/api/safety_filter.py.

38 tests pass (was 30 passing + 2 collection errors).

Other: added the MIT LICENSE the README badge already linked to, a .github/workflows/ci.yml running pytest + the dashboard build on every PR, and .vite//dist/ to .gitignore. Also guarded the JWT secret:

SECRET_KEY = os.getenv("JWT_SECRET")
if not SECRET_KEY:
 if os.getenv("NESTSHIFT_ENV", "development") == "production":
 raise RuntimeError("JWT_SECRET must be set when NESTSHIFT_ENV=production")
 SECRET_KEY = "dev-secret-change-in-prod"

Not addressed: RESEARCH.md still references figures/, which the same commit deleted.

Link to Devin session: https://app.devin.ai/sessions/202689cf4384414db4cbcb092a7ed2e7
Open in Devin Desktop: https://app.devin.ai/desktop/session/202689cf4384414db4cbcb092a7ed2e7?variant=devin
Requested by: @aryan597