feat(web): W3-1 login, session shell, home dashboard, settings, engine panel and audit pages

- /login: setup/login/TOTP states driven by server error codes, fixed-height error slot
- console layout: GET /auth/session gate, redirect to /login, account popover (change password, logout)
- home: six dashboard sections with SSE-driven refresh, automation switch and read-only reconcile toggle
- settings tabs: downloaders, media servers, library roots, path mappings, site credentials,
  API keys (one-time plaintext), Pi upstream, cache/organize/retention/budget, automation
- engine: runs list (status/name filters, cursor paging, stats tiles), run detail (step timeline,
  json payloads, signals, cancel)
- audit: filterable list with detail sheet
- vite: allow repo root in server.fs so deno-installed deps under node_modules/.deno load in dev

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/api/engine.ts

@@ -0,0 +1,50 @@
+import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import type { CursorPage, EngineRun, EngineRunDetail, EngineStats } from "@umt/contracts";
+import { apiData } from "~/lib/api.ts";
+import { qk } from "~/lib/query-keys.ts";
+
+export type EngineRunFilters = { status?: string; workflowName?: string };
+
+/** 终态:不能再 cancel */
+export const ENGINE_TERMINAL = new Set(["completed", "succeeded", "failed", "canceled"]);
+
+export function useEngineRuns(filters: EngineRunFilters) {
+  return useInfiniteQuery({
+    queryKey: qk.list("engine", filters),
+    initialPageParam: undefined as string | undefined,
+    queryFn: ({ pageParam, signal }) =>
+      apiData<CursorPage<EngineRun>>("/engine/runs", { params: { ...filters, cursor: pageParam, limit: 50 }, signal }),
+    getNextPageParam: (last) => last.nextCursor ?? undefined,
+  });
+}
+
+export function useEngineRun(id: string | undefined) {
+  return useQuery({
+    queryKey: qk.detail("engine", id ?? ""),
+    queryFn: ({ signal }) => apiData<EngineRunDetail>("/engine/runs/{id}", { pathParams: { id: id ?? "" }, signal }),
+    enabled: !!id,
+    // 非终态每 5 秒兜底刷新(SSE 事件驱动是主路径)
+    refetchInterval: (q) => (q.state.data && !ENGINE_TERMINAL.has(q.state.data.status) ? 5_000 : false),
+  });
+}
+
+export function useEngineStats() {
+  return useQuery({
+    queryKey: qk.engineStats,
+    queryFn: ({ signal }) => apiData<EngineStats>("/engine/stats", { signal }),
+    refetchInterval: 30_000,
+  });
+}
+
+export function useCancelEngineRun() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: ({ id, reason }: { id: string; reason?: string }) =>
+      apiData<{ canceled: boolean }>("/engine/runs/{id}/cancel", {
+        method: "POST",
+        pathParams: { id },
+        body: { reason },
+      }),
+    onSettled: () => qc.invalidateQueries({ queryKey: qk.all("engine") }),
+  });
+}