webui: add persistent GPU settings management (ECC/MIG/CC/power limit)

Adds a GPU Settings card to /tools for the settings that actually
persist on NVIDIA data-center GPUs: ECC mode, MIG mode, and
Confidential Computing mode (all stored in the GPU's inforom/firmware,
take effect after a GPU reset or reboot) plus power limit (does not
persist — reapplied on demand). Includes a one-click "Reset All to
Defaults" that restores factory settings across every visible GPU,
touching only whatever has actually drifted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/app/app.go

@@ -137,6 +137,12 @@ type satRunner interface {
 	RunConfidentialComputingCheckPack(ctx context.Context, baseDir string, logFunc func(string)) (string, error)
 	RunCPUAcceptancePack(ctx context.Context, baseDir string, durationSec int, logFunc func(string)) (string, error)
 	ListNvidiaGPUs() ([]platform.NvidiaGPU, error)
+	ListNvidiaGPUSettings() ([]platform.NvidiaGPUSetting, error)
+	SetNvidiaGPUECC(index int, enabled bool) (string, error)
+	SetNvidiaGPUMIG(index int, enabled bool) (string, error)
+	SetNvidiaGPUCCMode(index int, enabled bool) (string, error)
+	SetNvidiaGPUPowerLimit(index int, watts float64) (string, error)
+	ResetNvidiaGPUDefaults() (string, error)
 	DetectGPUVendor() string
 	ListAMDGPUs() ([]platform.AMDGPUInfo, error)
 	RunAMDAcceptancePack(ctx context.Context, baseDir string, logFunc func(string)) (string, error)

audit/internal/app/app_packs.go

@@ -39,6 +39,47 @@ func (a *App) ResetNvidiaGPU(index int) (ActionResult, error) {
 	return ActionResult{Title: fmt.Sprintf("Reset NVIDIA GPU %d", index), Body: strings.TrimSpace(out)}, err
 }
 
+func (a *App) ListNvidiaGPUSettings() ([]platform.NvidiaGPUSetting, error) {
+	return a.sat.ListNvidiaGPUSettings()
+}
+
+func (a *App) SetNvidiaGPUECC(index int, enabled bool) (ActionResult, error) {
+	out, err := a.sat.SetNvidiaGPUECC(index, enabled)
+	title := fmt.Sprintf("Enable ECC on GPU %d", index)
+	if !enabled {
+		title = fmt.Sprintf("Disable ECC on GPU %d", index)
+	}
+	return ActionResult{Title: title, Body: strings.TrimSpace(out)}, err
+}
+
+func (a *App) SetNvidiaGPUMIG(index int, enabled bool) (ActionResult, error) {
+	out, err := a.sat.SetNvidiaGPUMIG(index, enabled)
+	title := fmt.Sprintf("Enable MIG on GPU %d", index)
+	if !enabled {
+		title = fmt.Sprintf("Disable MIG on GPU %d", index)
+	}
+	return ActionResult{Title: title, Body: strings.TrimSpace(out)}, err
+}
+
+func (a *App) SetNvidiaGPUCCMode(index int, enabled bool) (ActionResult, error) {
+	out, err := a.sat.SetNvidiaGPUCCMode(index, enabled)
+	title := fmt.Sprintf("Enable Confidential Computing on GPU %d", index)
+	if !enabled {
+		title = fmt.Sprintf("Disable Confidential Computing on GPU %d", index)
+	}
+	return ActionResult{Title: title, Body: strings.TrimSpace(out)}, err
+}
+
+func (a *App) SetNvidiaGPUPowerLimit(index int, watts float64) (ActionResult, error) {
+	out, err := a.sat.SetNvidiaGPUPowerLimit(index, watts)
+	return ActionResult{Title: fmt.Sprintf("Set power limit on GPU %d", index), Body: strings.TrimSpace(out)}, err
+}
+
+func (a *App) ResetNvidiaGPUDefaults() (ActionResult, error) {
+	out, err := a.sat.ResetNvidiaGPUDefaults()
+	return ActionResult{Title: "Reset all GPUs to factory defaults", Body: strings.TrimSpace(out)}, err
+}
+
 func (a *App) RunNvidiaAcceptancePackWithOptions(ctx context.Context, baseDir string, diagLevel int, gpuIndices []int, logFunc func(string)) (ActionResult, error) {
 	if strings.TrimSpace(baseDir) == "" {
 		baseDir = DefaultSATBaseDir

audit/internal/app/app_test.go

@@ -235,6 +235,30 @@ func (f fakeSAT) ResetNvidiaGPU(index int) (string, error) {
 	return "", nil
 }
 
+func (f fakeSAT) ListNvidiaGPUSettings() ([]platform.NvidiaGPUSetting, error) {
+	return nil, nil
+}
+
+func (f fakeSAT) SetNvidiaGPUECC(index int, enabled bool) (string, error) {
+	return "", nil
+}
+
+func (f fakeSAT) SetNvidiaGPUMIG(index int, enabled bool) (string, error) {
+	return "", nil
+}
+
+func (f fakeSAT) SetNvidiaGPUCCMode(index int, enabled bool) (string, error) {
+	return "", nil
+}
+
+func (f fakeSAT) SetNvidiaGPUPowerLimit(index int, watts float64) (string, error) {
+	return "", nil
+}
+
+func (f fakeSAT) ResetNvidiaGPUDefaults() (string, error) {
+	return "", nil
+}
+
 func (f fakeSAT) RunMemoryAcceptancePack(_ context.Context, baseDir string, _, _ int, _ func(string)) (string, error) {
 	return f.runMemoryFn(baseDir)
 }