feat(indexer): Tree API, project/tonnage API, fix relationships array search bug (#4509)

[XananasX7]

Summary

Closes #4509

Implements all three requirements from the issue and addresses multiple use-cases from the Max use-case spreadsheet.

---

1. Bug fix — VC/VP search by role relationship ID (Use-case #7)

The confirmed bug: "Token mint VCs are not showing when searching role IDs under relationships" (Role ID: 1712136267.281823003 in the spreadsheet notes).

Root cause: parsePageFilters() in entities.service.ts applied $regex to every field including options.relationships, which is stored as a MongoDB array. $regex never matches inside arrays — it silently returns zero results.

Fix: Added ARRAY_FILTER_FIELDS set (options.relationships, options.tokens) that uses $elemMatch: { $eq: value } instead of $regex. Also added a MongoDB index on options.relationships for query performance.

This fix applies to both GET_VC_DOCUMENTS and GET_VP_DOCUMENTS — any filter on options.relationships now works correctly.

---

2. GET /analytics/projects — Project/Tonnage API

New endpoint returning aggregate Mint Token VC data per policy project:

GET /analytics/projects?pageIndex=0&pageSize=25&orderDir=DESC&minMinted=10000

Response per project:

• totalMinted — sum of all mint events (credits issued)
• mintEventCount — number of Mint Token VCs
• tokens[] — per-token breakdown (tokenId, tokenName, totalMinted, mintEventCount, lastMintTimestamp)
• policyId, policyName, owner, topicId

Addresses use-cases:

• Merge Guardian Project #2 (Organizational carbon credit procurement) — find consistent large suppliers, sort by totalMinted
• Link to the Usage Demo Guide is invalid #7 (Project developer track record) — discover all mint VCs per developer with aggregate data

---

3. GET /analytics/vc-tree/:messageId — Tree API

New endpoint returning the full VC document relationship tree rooted at a given message:

GET /analytics/vc-tree/1706823227.586179534?maxDepth=10

Returns a recursive tree traversing options.relationships at each node, with:

• nodeCount, depth, rootId
• Per-node: messageId, type, schemaName, schemaId, issuer, policyId, tokenAmount, tokenId

Addresses: "Tree API for consumer eCommerce supportive transactions" requirement from the issue.

---

4. Frontend: Projects & Tonnage view (/projects)

New Angular standalone component at route /projects:

• Sortable, paginated table of policies with aggregate mint tonnage data
• Filters: owner/registry DID, policyId, minimum minted threshold
• Accessible via Methodologies menu → Projects & Tonnage
• Row click navigates to existing policy detail page

---

Files changed

Layer	File	Change
indexer-common	messages/message-api.ts	+2 message API keys
indexer-api-gateway	api/services/analytics.ts	+2 new endpoints (GET /projects, GET /vc-tree/:id)
indexer-api-gateway	dto/project-tonnage.dto.ts	New Swagger DTOs
indexer-api-gateway	dto/vc-tree.dto.ts	New Swagger DTOs
indexer-service	api/analytics.service.ts	+2 message handlers
indexer-service	api/entities.service.ts	Bug fix: $elemMatch for array fields
indexer-service	app.ts	+MongoDB index on options.relationships
indexer-frontend	views/projects/*	New Projects & Tonnage view
indexer-frontend	services/analytics.service.ts	+getProjects(), getVcTree()
indexer-frontend	app.routes.ts	+/projects route
indexer-frontend	components/header/header.component.ts	+nav link

Related issues

• Directly implements all requirements of Enhancement to Indexer #4509
• Fixes underlying bug affecting Indexer: finding suitable carbon credits #5021, Indexer: search for common project practices #5019, Indexer: advanced search  #5022 use-cases (relationships array filter)

[XananasX7]

Fixed two CI blockers across all 4 PRs:

Title Check / conventional-pr-title: Removed the BOUNTY-XXXX: prefix from all PR titles so they now follow the type(scope): description conventional commits format that Guardian's CI validates.

DCO: Added Signed-off-by to the commit on each branch via git commit --amend --signoff. The DCO check should now pass.

Assignee check is a maintainer action (can't self-assign on this repo). Otherwise all other checks (Wiz, Snyk, StepSecurity) were already passing.