feat(bigip): surface the three AWAF forms + honest declines in the console & report

[henleda]

What & why

Task A of the BIG-IP resume: the console ④ Mitigate "Apply on your own BIG-IP" panel (PRs #47–#48) and the standalone report predate waf_data_guard and api_schema, so they didn't reflect the current forms. The backend was already correct — apply_bigip dispatches through emit(target="bigip-awaf") and handles all three shipped forms while honestly declining the rest — so this is a purely presentational fix. Offline throughout (no lab).

Audit findings (all verified before changing anything)

Console panel — dropdown hardcoded to service_policy (index.html:638), so waf_data_guard/api_schema findings were unreachable and no decline was ever surfaced. Help text said "Only service_policy band-aids have an AWAF form today" (stale).

Report — no BIG-IP surface at all, and a verified crash: a BIG-IP apply wrote before_after as a [before, after] list (bigip_apply.py:205) while every XC apply writes a {before, after} dict; the report does ba.get("before"), so building a report after any BIG-IP apply raised AttributeError: 'list' object has no attribute 'get'. (export.py:142 already guarded this shape and silently dropped it.)

Changes

Console

• "Apply on your own BIG-IP" dropdown now driven by /api/emit (target bigip-awaf) — the emitter is the source of truth, so all three forms are selectable and every declining control is listed inline with its reason. Help text rewritten.
• Refreshed the ② Review "Emit for another WAF" copy to name all three forms + the waf staging decline.

Report

• Root-caused the before_after list→dict inconsistency in bigip_apply.py (fixes the crash + the export drop). _impact_rows also normalizes the legacy list shape so reports over pre-fix audit logs still render.
• New "BIG-IP Advanced WAF (bring-your-own)" section, computed per-finding from the same emitter over the run's policies.json + probes.json: names the form emitted for each finding, and splits declines into "no Advanced-WAF object at all" (XC-only, structural) vs "form exists but this finding lacked the data". No fabricated "supported" states.
• apply_bigip_awaf now labelled in the impact table.

emitters.py — AWAF_FORMS registry (form names in one place, read by the report) + shared WAF_STAGING_REASON constant.

Tests

+7 tests (emitter registry↔emit consistency, report BIG-IP section + decline split, the crash regression + legacy-list tolerance, the /api/emit panel contract). Full suite 1126 pass, 15 skipped, ruff clean.

🤖 Generated with Claude Code