fix(scores,reports): fix scores/history 500, disable unfinished report generation cleanly

- /scores/history was annotated -> dict but the service actually returns
  a list, so FastAPI's response validation raised an unhandled exception,
  surfacing as a raw 500 on every call. Fixed the annotation.
- The professional_reports.py endpoints (PDF/DOCX/HTML generation) back
  a Reports feature the frontend already hides entirely (unfinished).
  Hitting them directly fell through to whatever the render pipeline
  raised (e.g. missing weasyprint system deps) as an unhelpful 500.
  Added a REPORTS_ENABLED setting (off by default) so they now return a
  clean 503 instead, without removing the routes or their test coverage.

backend/app/config.py

@@ -107,6 +107,11 @@ class Settings(BaseSettings):
     STALE_THRESHOLD_DAYS: int = 365  # days before coverage is considered stale
 
     # ── Reporting ─────────────────────────────────────────────────────
+    # PDF/DOCX/HTML report generation (professional_reports router) is
+    # unfinished — the frontend hides the Reports UI entirely. Defaults
+    # off so a fresh deploy returns a clean 503 instead of a raw 500 from
+    # a half-working render pipeline (e.g. missing weasyprint system deps).
+    REPORTS_ENABLED: bool = False
     REPORT_TEMPLATES_DIR: str = "app/templates/reports"
     # Assign REPORT_OUTPUT_DIR = "/tmp/aegis_reports"
     REPORT_OUTPUT_DIR: str = "/app/reports"

backend/app/routers/professional_reports.py

@@ -40,6 +40,18 @@ def _assert_safe_report_path(filepath: str) -> str:
         raise HTTPException(status_code=500, detail="Report generation path error")
     return filepath
 
+
+def _assert_reports_enabled() -> None:
+    """Raise a clean 503 while report generation is unfinished/disabled.
+
+    The frontend hides the Reports UI entirely; without this guard, hitting
+    these endpoints directly falls through to whatever the underlying
+    render pipeline raises (e.g. missing weasyprint system deps) as a raw,
+    unhelpful 500.
+    """
+    if not settings.REPORTS_ENABLED:
+        raise HTTPException(status_code=503, detail="Report generation is not yet available on this platform")
+
 # Assign router = APIRouter(prefix="/reports/generate", tags=["professional-reports"])
 router = APIRouter(prefix="/reports/generate", tags=["professional-reports"])
 
@@ -72,6 +84,7 @@ def generate_purple_report(
     user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
 ) -> FileResponse:
     """Generate a Purple Team campaign assessment report."""
+    _assert_reports_enabled()
     # Assign filepath = report_generation_service.generate_purple_campaign_report(
     filepath = report_generation_service.generate_purple_campaign_report(
         db, str(campaign_id), output_format=format,
@@ -102,6 +115,7 @@ def generate_coverage_report(
     user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
 ) -> FileResponse:
     """Generate an organization-wide MITRE ATT&CK coverage report."""
+    _assert_reports_enabled()
     # Assign filepath = report_generation_service.generate_coverage_report(
     filepath = report_generation_service.generate_coverage_report(
         db, output_format=format,
@@ -132,6 +146,7 @@ def generate_executive_report(
     user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
 ) -> FileResponse:
     """Generate an executive security summary report."""
+    _assert_reports_enabled()
     # Assign filepath = report_generation_service.generate_executive_summary(
     filepath = report_generation_service.generate_executive_summary(
         db, output_format=format,
@@ -162,6 +177,7 @@ def generate_quarterly_report(
     user: User = Depends(require_any_role("red_lead", "blue_lead", "viewer")),
 ) -> FileResponse:
     """Generate a quarterly security summary report."""
+    _assert_reports_enabled()
     # Assign filepath = report_generation_service.generate_quarterly_summary(
     filepath = report_generation_service.generate_quarterly_summary(
         db, output_format=format,
@@ -194,6 +210,7 @@ def generate_technique_report(
     user: User = Depends(get_current_user),
 ) -> FileResponse:
     """Generate a detailed report for one MITRE technique."""
+    _assert_reports_enabled()
     # Assign filepath = report_generation_service.generate_technique_detail_report(
     filepath = report_generation_service.generate_technique_detail_report(
         db, str(technique_id), output_format=format,

backend/app/routers/scores.py

@@ -165,7 +165,7 @@ def score_history(
     db: Session = Depends(get_db),
     # Entry: current_user
     current_user: User = Depends(get_current_user),
-) -> dict:
+) -> list:
     """Get historical score data points (weekly).
 
     Args:
@@ -174,7 +174,7 @@ def score_history(
         current_user (User): Authenticated user making the request.
 
     Returns:
-        dict: Weekly score data points for the requested period.
+        list: Weekly score data points for the requested period.
     """
     # Return get_score_history(db, period)
     return get_score_history(db, period)