Add an optional benchmarks page for E2E eval results

[PunchBui]

Summary

Adds an optional Benchmarks page: a models × skills matrix of E2E eval results on main, with a per-test breakdown for each skill. Off by default; enable with DROPMCP_BENCHMARKS=true.

Page

• An Overall row gives each model's average score, pass count and test coverage; an All models column gives each skill's average.
• Latest shows the newest result per test and model. 60-day average shows the mean of every run in the window and colours a cell by whether that average meets the threshold. ▲/▼ compare the newest result with the window average, and expanded tests show a trend line of recent scores.
• Columns are ranked by the selected average. Compact and a model picker (with All / Top 5 presets) keep wide comparisons readable. The view is kept in the URL (metric, sort, compact, models) so it can be shared.
• The header link is shown only to identified users.

API and data

• The page reports eval_results_project only. /api/benchmarks takes no project parameter, so callers cannot select another project's data.
• The data source is supplied by the deployment as benchmark_results_store. Enabling the page without a project or a valid store fails at startup. No query, host or credential defaults ship in the library, in line with Stop shipping deployment-specific StarRocks queries #41.
• MySQLBenchmarkResultsStore (in eval_results_mysql.py, mysql extra) runs caller-supplied SQL bound as (project, datadate). Credentials and the datadate format are chosen by the caller, so partition keys that are not ISO dates prune correctly. Query failures propagate so the page reports an outage rather than an empty result.
• /api/benchmarks answers 401 without the identity header and never returns reasoning or error text. Responses are no-store, nosniff and no-referrer.
• Every run in the lookback window is kept, so history needs no extra query.

Things to know

• The identity header is trusted as sent, exactly as /api/me and the subscription routes already do. The 401 and the hidden link are a usability gate, not access control; put an authenticating proxy in front of the server and deny /benchmarks and /api/benchmarks to everyone else. The README says so.
• Payload size grows with tests × models (about 390 KB uncompressed for 46 tests × 20 models, about 70 KB gzipped). Loading a skill's per-test detail on expand would be the fix if that becomes a problem; not done here.
• History mixes commits. A real improvement to a skill shifts the average, so read it with the ▲/▼ and the run count.
• New dependency: @tanstack/react-query (MIT, about 12 kB gzipped). The page loads its data with useQuery and a single QueryClientProvider at the root, instead of useEffect plus hand-rolled loading and error state. It is the only consumer; the other pages still fetch in useEffect. It is its own commit (efa338c), so it is easy to drop or to migrate the rest over if you would rather not add the dependency in this PR.
• The existing _datadate_cutoff in eval_results_mysql.py is untouched. It still binds an ISO date; changing it would change which rows /api/telemetry returns.

Test plan

• ruff check src
• pytest: 249 passed (203 before this change)
• npm run lint and npm run build
• npx playwright test tests/benchmarks.spec.ts: 27 passed. The existing screenshot tests only have Linux baselines, so they were not run locally; this change adds no screenshot snapshots.
• Tests were checked against deliberate breakages (auth check, cache header, ordering, colouring, partition format, connection cleanup) and fail as expected.
• Ran the server locally against a fake store with 20 models and looked at light, dark, compact, history and mobile layouts.
• Not run against a real database.

🤖 Generated with Claude Code