feat: merge backoffice provider flags into /features [SUP-829]

[Dominikkq]

What:

Fetches the provider flags (FLYOVER, UNION_BRIDGE, POWPEG) from the
backoffice API and merges them into /features as
flyover/union_bridge/powpeg (enabled/disabled).

• New BackofficeFeatureFlagsService: session login, re-login on 401,
  stale-while-revalidate cache (60s TTL), serves last known values if the
  backoffice is down. Disabled unless BACKOFFICE_* env vars are set
  (see ENV_VARIABLES.md).
• Bumps @types/node 16 → 20 for native fetch types.
• Unit-tested and verified against a live backoffice; existing /features
  consumers unaffected.

Task:
SUP-829

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@types/node	20.19.43	🟢 6.6	Details Check Score Reason Code-Review 🟢 9 Found 28/29 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed

Scanned Files

• package-lock.json

[Copilot]

Pull request overview

Adds an optional Backoffice integration that fetches provider availability flags and merges them into the existing /features response without changing existing consumers’ contract.

Changes:

• Introduces BackofficeFeatureFlagsService to authenticate to Backoffice, fetch provider flags, and cache them with stale-while-revalidate behavior.
• Merges FLYOVER/UNION_BRIDGE/POWPEG into /features as flyover/union_bridge/powpeg with enabled/disabled, and wires the new service via DI.
• Updates Node type definitions (for native fetch typings), adds unit tests, and documents new env vars.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/services/index.ts	Re-exports the new Backoffice flags service.
src/services/daemon.service.ts	Updates timer typing to NodeJS.Timeout for Node 20 types.
src/services/backoffice-feature-flags.service.ts	Implements Backoffice login + flag retrieval + SWR cache and feature-merge helper.
src/dependency-injection-handler.ts	Binds BackofficeFeatureFlagsService as a singleton in LoopBack DI.
src/dependency-injection-bindings.ts	Adds DI binding key for the new service.
src/controllers/features.controller.ts	Calls Backoffice flags service and merges provider flags into /features output.
src/tests/unit/services/backoffice-feature-flags.service.unit.ts	Adds unit coverage for caching/relogin/error fallback and merge behavior.
src/tests/unit/features.controller.unit.ts	Extends controller tests to validate merged flags and fallback behavior.
package.json	Bumps @types/node to v20 for native fetch typings.
package-lock.json	Lockfile updates aligned with @types/node bump.
ENV_VARIABLES.md	Documents new BACKOFFICE_* env vars and behavior.

[alexjavabraz]

Don't need to hard-code these values. We want to configure this and receive it from feature flags.

[alexjavabraz]

Will this impact CI/CD?

[Dominikkq]

No, its type definitions only, just because old @types/node 16 didn't have native fetch typings

[alexjavabraz]

LGTM