feat: add current match page and live kill feed

ai/system-metrics.md

@@ -18,3 +18,4 @@ Date | Task | Duration | Result | Notes
 2026-05-19T08:39:12 | worker-cycle | 663.71 sec | success | codex-runner
 2026-05-19T17:20:44 | worker-cycle | 2240.22 sec | success | codex-runner
 2026-05-21T14:43:44 | worker-cycle | 5580.9 sec | success | codex-runner
+2026-05-21T15:17:18 | worker-cycle | 688.86 sec | success | codex-runner

ai/tasks/done/TASK-150-server-card-history-and-current-match-entrypoints.md

@@ -1,7 +1,7 @@
 ---
 id: TASK-150
 title: Server card history and current match entrypoints
-status: pending
+status: done
 type: frontend
 team: Frontend Senior
 supporting_teams: []
@@ -164,9 +164,24 @@ historical page can open directly filtered by server.
 
 ## Outcome
 
-Document the validation performed, URL trust boundary decisions, historical
-filter initialization behavior, and any follow-up task instead of expanding
-scope.
+- Replaced the home server-card history URL path with a trusted frontend action
+  catalog for active servers `comunidad-hispana-01` and
+  `comunidad-hispana-02` only. Payload-provided `community_history_url`
+  values and the previous server #03 fallback are no longer used for those
+  card actions.
+- Added the three per-server entrypoints from trusted constants: public
+  scoreboard base URL, internal historical filter URL and internal current
+  match URL.
+- Confirmed `frontend/assets/js/historico.js` already normalizes the supported
+  `?server=` values into the active selector and falls back to `all-servers`
+  for unknown or missing values, so no historical page code change was needed.
+- Added a minimal `partida-actual.html` placeholder with a trusted server label
+  map and safe internal links for TASK-151 to upgrade.
+- Validation: `node --check frontend/assets/js/main.js`.
+- Scope review: `git diff --name-only` and `git status --short` were reviewed
+  for the task move plus frontend files. Browser click verification was not
+  completed because the in-app browser JavaScript control tool was not
+  available after tool discovery in this session.
 
 ## Change Budget
 

ai/tasks/done/TASK-151-current-match-page-base.md

@@ -1,7 +1,7 @@
 ---
 id: TASK-151
 title: Current match page base
-status: pending
+status: done
 type: frontend
 team: Frontend Senior
 supporting_teams:
@@ -159,8 +159,29 @@ live server/match state without pretending the match is closed.
 
 ## Outcome
 
-Document the live-state source, polling behavior, validation performed, and any
-follow-up task instead of expanding scope.
+- Upgraded `partida-actual.html` into the first internal live match page and
+  kept it aligned with the existing historical shell/styles.
+- Added frontend polling every 30 seconds with an in-flight guard. The page
+  rejects unknown `?server=` values before building any external link, and the
+  public scoreboard button is populated only from the trusted backend
+  projection.
+- Added read-only `GET /api/current-match?server=`. It supports only active
+  trusted scoreboard origins and projects the existing live server snapshot
+  fields into the current-match shape. The current live snapshot persistence
+  exposes status, map, population and capture time; score, game mode and match
+  start fields remain `null`/unavailable when the snapshot source does not
+  provide them.
+- Kept the combat feed and live player statistics as honest empty placeholders
+  for the follow-up tasks rather than fabricating closed-match or kill data.
+- Validation: `python -m compileall backend/app`;
+  `node --check frontend/assets/js/partida-actual.js`;
+  `powershell -ExecutionPolicy Bypass -File scripts/run-integration-tests.ps1`;
+  narrow inline route guard check for missing/unknown current-match server
+  values; narrow inline payload projection check using a controlled live
+  snapshot document.
+- Scope review: `git diff --name-only` and `git status --short` were reviewed.
+  No focused product route test file exists in `backend/tests` for this API
+  bootstrap layer yet.
 
 ## Change Budget
 

ai/tasks/done/TASK-152-current-match-live-kill-feed.md

@@ -1,7 +1,7 @@
 ---
 id: TASK-152
 title: Current match live kill feed
-status: pending
+status: done
 type: backend
 team: Backend Senior
 supporting_teams:
@@ -139,8 +139,33 @@ feed based on RCON/AdminLog data.
 
 ## Outcome
 
-Document the feed scope and confidence behavior, event normalization choices,
-polling validation, and any follow-up task instead of expanding scope.
+- Added read-only `GET /api/current-match/kills?server=&limit=` for the active
+  trusted Comunidad Hispana servers. Unsupported servers fail before any
+  AdminLog query is built.
+- Added a safe AdminLog kill feed read that emits normalized fields only:
+  generated `event_id`, event time/server time, killer/victim names and teams,
+  weapon, and computed `is_teamkill`. It does not return raw AdminLog text,
+  player ids or admin-only payload fields.
+- Feed scope prefers `open-admin-log-match-window` with
+  `confidence: "admin-log-boundary"` when the latest AdminLog boundary for the
+  server is an unmatched `match_start`. Otherwise it returns
+  `recent-admin-log-window` with `confidence: "partial"` as the explicit
+  fallback.
+- Extended `partida-actual.js` to poll the feed with the existing 30-second
+  in-flight-protected current-match refresh cycle, dedupe rows by `event_id`,
+  keep newest events ordered by server/event time, render a TK badge for
+  teamkills, and show empty/error states without fake rows.
+- Added a focused AdminLog storage test for open-window filtering and teamkill
+  normalization. The environment does not have `pytest` installed (`pytest`
+  and `python -m pytest` both failed), so the same storage normalization path
+  was verified with a narrow inline Python scenario.
+- Validation: `python -m compileall backend/app`;
+  `node --check frontend/assets/js/partida-actual.js`;
+  `powershell -ExecutionPolicy Bypass -File scripts/run-integration-tests.ps1`;
+  narrow inline route guard check for missing, unknown and invalid-limit feed
+  requests; inline storage normalization check excluding pre-window kills and
+  confirming no raw message field leaks.
+- Scope review: `git diff --name-only` and `git status --short` were reviewed.
 
 ## Change Budget