Add n8n procurement vendor-risk cookbook

[s-jag]

Summary

Adds the full n8n procurement vendor-risk cookbook under typescript-recipes/parallel-n8n-procurement.

This now includes both parts of the end-to-end app:

• n8n-workflows/workflow-combined.json: canonical single-import n8n workflow.
• dashboard/: live-data Next.js dashboard for overview, attention queue, portfolio manager, feed, Observe topology, and vendor detail pages.

The dashboard is now read/write for portfolio add, CSV upload, and reset. Runtime reads still come from the procurement-dashboard-snapshot webhook, and writes go through the local Next.js POST /api/portfolio/mutation proxy to the n8n procurement-portfolio-mutation webhook. Next sends x-procurement-dashboard-token; n8n validates it against PROCUREMENT_DASHBOARD_WRITE_TOKEN before writing to Google Sheets.

Details

• Adds the procurement TypeScript package, workflow generators, tests, Google Sheets templates, and generated workflow JSON.
• Keeps workflow-combined.json as the primary import path; individual workflow JSON files remain advanced/reference artifacts.
• Updates cookbook discovery in the root README and website/cookbook.json.
• Adds the dashboard app from the procurement integration demo.
• Refactors dashboard runtime data loading to require PROCUREMENT_DASHBOARD_SNAPSHOT_URL.
• Adds dashboard mutation env vars: PROCUREMENT_DASHBOARD_MUTATION_URL and PROCUREMENT_DASHBOARD_WRITE_TOKEN.
• Replaces portfolio localStorage persistence with backend mutations for add/upload/reset.
• Adds n8n portfolio mutation region that reads current Vendors/Registry, validates the shared secret, builds normalized rows, writes both tabs, and returns a mutation result.
• Updates sync diffing so active rows drive add/modify calculations while inactive registry rows with monitor IDs can still be removed by the existing sync path.
• Updates Snapshot: Build Payload so the procurement-dashboard-snapshot webhook returns the dashboard view model derived from Registry, Audit Log, and Monitors tabs.
• Updates Google Sheets templates with dashboard-owned fields including relationship_owner, region, risk_score, next_research_date, last_synced_at, and dashboard_managed.
• Adds Playwright browser coverage with local mocked snapshot and mutation endpoints for API contract and UI flows.

The combined workflow now has 56 nodes, 49 connection sources, 6 webhook triggers, 2 schedule triggers, and zero executeWorkflow / executeWorkflowTrigger nodes.

Validation

Main recipe:

npm ci
npm run check
npm test
npm run generate:workflows

Dashboard:

cd dashboard
npm ci
npm run check
npm run build
npm run test:e2e

Observed results:

• Main recipe clean install completed from package-lock.json.
• Main recipe typecheck passed.
• Main recipe Vitest passed: 30 files, 569 tests.
• Workflow JSON regenerated from TypeScript generators.
• Dashboard clean install completed from dashboard/package-lock.json.
• Dashboard typecheck passed.
• Dashboard production build passed, including POST /api/portfolio/mutation.
• Dashboard Playwright passed: 6 tests covering navigation, vendor detail, backend-backed add/persist/reset, CSV upload/reset, failed mutation UI, feed controls, Observe controls, snapshot API contract, and shared-secret mutation contract.
• git diff --check passed.
• No live credentials matched the secret-pattern scan; ignored node_modules, .next, dist, and Playwright test-results artifacts are not staged.

Before Marking Ready

• Import n8n-workflows/workflow-combined.json into a real n8n Cloud workspace.
• Smoke test the dashboard against the live procurement-dashboard-snapshot and procurement-portfolio-mutation webhooks.